theory CSpace_C

lemma Arch_maskCapRights_ccorres [corres]:
  "ccorres ccap_relation ret__struct_cap_C_'
  \<top>
  (UNIV \<inter> \<lbrace>ccap_relation (ArchObjectCap arch_cap) \<acute>cap\<rbrace> \<inter>
  \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>)
  []
  (return (Arch.maskCapRights R arch_cap))
  (Call Arch_maskCapRights_'proc)" apply (cinit' (trace) lift: cap_' cap_rights_mask_') apply csymbr apply (unfold ARM_H.maskCapRights_def) apply (simp only: Let_def) apply (case_tac "cap_get_tag cap = scast cap_small_frame_cap") apply (clarsimp simp add: ccorres_cond_iffs cap_get_tag_isCap isCap_simps) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cap_get_tag_isCap isCap_simps) apply (clarsimp simp: return_def) apply (unfold ccap_relation_def)[1] apply (simp add: cap_small_frame_cap_lift [THEN iffD1]) apply (clarsimp simp: cap_to_H_def) apply (simp add: map_option_case split: option.splits) apply (clarsimp simp add: cap_to_H_def Let_def split: cap_CL.splits if_split_asm) apply (simp add: cap_small_frame_cap_lift_def) apply (simp add: ccap_rights_relation_def) apply (simp add: cap_small_frame_cap_lift_def) apply (simp add: ccap_rights_relation_def) apply (simp add: pageSize_def) apply (simp add: pageSize_def) apply (clarsimp simp add: cap_get_tag_isCap isCap_simps simp del: not_ex) apply (rule conjI, clarsimp) apply (simp add: ccorres_cond_iffs) apply (rule ccorres_guard_imp) apply (csymbr) apply (case_tac "cap_get_tag cap = scast cap_frame_cap") apply (clarsimp simp add: ccorres_cond_iffs cap_get_tag_isCap isCap_simps simp del: not_ex) apply (rule ccorres_from_vcg_throws [where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cap_get_tag_isCap isCap_simps simp del: not_ex) apply (clarsimp simp: return_def) apply (unfold ccap_relation_def)[1] apply (simp add: cap_frame_cap_lift [THEN iffD1]) apply (clarsimp simp: cap_to_H_def) apply (simp add: map_option_case split: option.splits) apply (clarsimp simp add: isCap_simps pageSize_def cap_to_H_def Let_def simp del: not_ex
                          split: cap_CL.splits if_split_asm) apply (simp add: cap_frame_cap_lift_def) apply (simp add: ccap_rights_relation_def) apply (simp add: c_valid_cap_def cl_valid_cap_def cap_lift_frame_cap) apply (simp add: cap_frame_cap_lift_def) apply (simp add: ccap_rights_relation_def) apply (simp add: c_valid_cap_def cl_valid_cap_def cap_lift_frame_cap) apply (clarsimp simp add: cap_get_tag_isCap isCap_simps simp del: not_ex)+ apply (simp add: ccorres_cond_iffs) apply (rule ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp add: return_def simp del: not_ex) apply (cases arch_cap) by (fastforce simp add: cap_get_tag_isCap isCap_simps  simp del: not_ex simp_thms(44))+

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap arch_cap) \<acute>cap\<rbrace> \<inter> \<lbrace>ccap_rights_relation R \<acute>cap_rights_mask\<rbrace>) [] (return (Arch.maskCapRights R arch_cap)) (Call Arch_maskCapRights_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?Q'864 cap_rights_mask cap) [SKIP] (return (Arch.maskCapRights R arch_cap)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q864 cap_rights_mask cap s \<and> s' \<in> ?Q'864 cap_rights_mask cap proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap ret__unsigned) [SKIP] (return (Arch.maskCapRights R arch_cap)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q864 cap_rights_mask cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'873 cap_rights_mask cap v} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap ret__unsigned) [SKIP] (return (let c = arch_cap in if isPageCap c then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights c) R) c else capability.ArchObjectCap c)) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q864 cap_rights_mask cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'873 cap_rights_mask cap v} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap (cap_get_tag cap)) [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q864 cap_rights_mask cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'873 cap_rights_mask cap v} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap (cap_get_tag cap)) [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap (cap_get_tag cap)) [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q864 cap_rights_mask cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'873 cap_rights_mask cap v} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap (cap_get_tag cap)) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data))) (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q864 cap_rights_mask cap) (?G'873 cap_rights_mask cap (cap_get_tag cap)) [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q864 cap_rights_mask cap s \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'873 cap_rights_mask cap v} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>t. ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap) \<longrightarrow> (\<forall>t. ret__unsigned_long_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap) \<longrightarrow> cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap) && mask 2 = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap) \<and> (\<forall>t. vmrights_to_H (ret__unsigned_long_' t) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> ret__unsigned_long_' t && mask 2 = ret__unsigned_long_' t \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = ret__unsigned_long_' t \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<and> (\<forall>ta. cap_small_frame_cap_lift (ret__struct_cap_C_' ta) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' t\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap), vm_rights_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, ret__struct_cap_C_' := ret__struct_cap_C_' ta, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' ta)))))))}
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (return (capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data)) (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; Some (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = map_option cap_to_H (cap_lift cap) \<and> c_valid_cap cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> Some (capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data)) = map_option cap_to_H (cap_lift (ret__struct_cap_C_' td)) \<and> c_valid_cap (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; Some (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = map_option cap_to_H (cap_lift cap) \<and> c_valid_cap cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> capability.ArchObjectCap (arch_capability.PageCap d ref (maskVMRights rghts R) sz data) = cap_to_H (Cap_small_frame_cap (cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>))
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; Some (capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data)) = map_option cap_to_H (cap_lift cap); c_valid_cap cap\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0 \<longrightarrow> d = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> ref = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights rghts R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> sz = Wellformed_C.ARMSmallPage \<and> data = None) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> ref = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights rghts R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> sz = Wellformed_C.ARMSmallPage \<and> data = Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> ref = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights rghts R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> sz = Wellformed_C.ARMSmallPage \<and> data = Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)))
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d ref rghts sz data \<sigma> x t ta tb tc td x2. \<lbrakk>c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (cap_to_H x2) = Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d ref rghts sz data; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some x2; capability.ArchObjectCap (arch_capability.PageCap d ref rghts sz data) = cap_to_H x2\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0 \<longrightarrow> d = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> ref = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights rghts R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> sz = Wellformed_C.ARMSmallPage \<and> data = None) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> ref = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights rghts R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> sz = Wellformed_C.ARMSmallPage \<and> data = Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> ref = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights rghts R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> sz = Wellformed_C.ARMSmallPage \<and> data = Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap), cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)))
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x8. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_small_frame_cap x8); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage None)) = Wellformed_C.ARMSmallPage; cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 = 0; cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage None\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x8. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_small_frame_cap x8); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8)))) = Wellformed_C.ARMSmallPage; 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8; arch_cap = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = 0 \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)))
 3. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None)) = Wellformed_C.ARMSmallPage; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 4. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9)))) = Wellformed_C.ARMSmallPage; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 5. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x8. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL x8; ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL x8; vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; (case cap_lift (ret__struct_cap_C_' td) of Some (Cap_small_frame_cap rec) \<Rightarrow> rec) = x8\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_small_frame_cap x8); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage None)) = Wellformed_C.ARMSmallPage; cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 = 0; cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage None\<rbrakk> \<Longrightarrow> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x8. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_small_frame_cap x8); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8)))) = Wellformed_C.ARMSmallPage; 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8; arch_cap = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = 0 \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)))
 3. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None)) = Wellformed_C.ARMSmallPage; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 4. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9)))) = Wellformed_C.ARMSmallPage; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 5. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x8. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_small_frame_cap x8); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8)))) = Wellformed_C.ARMSmallPage; 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8; arch_cap = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = 0 \<longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<longrightarrow> to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8) = to_bool (cap_small_frame_cap_CL.capFIsDevice_CL (cap_small_frame_cap_lift cap)) \<and> cap_small_frame_cap_CL.capFBasePtr_CL x8 = cap_small_frame_cap_CL.capFBasePtr_CL (cap_small_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = (cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap) \<and> cap_small_frame_cap_CL.capFMappedAddress_CL x8 = cap_small_frame_cap_CL.capFMappedAddress_CL (cap_small_frame_cap_lift cap)))
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None)) = Wellformed_C.ARMSmallPage; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 3. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9)))) = Wellformed_C.ARMSmallPage; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 4. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 5. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x8. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL x8; ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL x8; vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; (case cap_lift (ret__struct_cap_C_' td) of Some (Cap_small_frame_cap rec) \<Rightarrow> rec) = x8\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_small_frame_cap x8); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8)))) = Wellformed_C.ARMSmallPage; 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8; arch_cap = arch_capability.PageCap (to_bool (cap_small_frame_cap_CL.capFIsDevice_CL x8)) (cap_small_frame_cap_CL.capFBasePtr_CL x8) (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) Wellformed_C.ARMSmallPage (Some ((cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 << local.asid_low_bits) + cap_small_frame_cap_CL.capFMappedASIDLow_CL x8, cap_small_frame_cap_CL.capFMappedAddress_CL x8))\<rbrakk> \<Longrightarrow> (cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 = 0 \<and> cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 = 0 \<longrightarrow> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<longrightarrow> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 \<longrightarrow> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)))) \<and> (0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL x8 \<longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL x8 \<longrightarrow> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask))) \<and> maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) R = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL x8)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)))
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None)) = Wellformed_C.ARMSmallPage; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 3. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9)))) = Wellformed_C.ARMSmallPage; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 4. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 5. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (4 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None)) = Wellformed_C.ARMSmallPage; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9)))) = Wellformed_C.ARMSmallPage; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 3. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 4. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); ret__unsigned_long_' ta = cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_small_frame_cap_CL.capFVMRights_CL (cap_small_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_small_frame_cap_lift (ret__struct_cap_C_' td) = cap_small_frame_cap_lift cap\<lparr>cap_small_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9)))) = Wellformed_C.ARMSmallPage; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<or> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDHigh_CL (cap_small_frame_cap_lift cap) \<and> \<not> 0 < cap_small_frame_cap_CL.capFMappedASIDLow_CL (cap_small_frame_cap_lift cap)
 2. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (if isPageCap arch_cap then capability.ArchObjectCap $ capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap else capability.ArchObjectCap arch_cap)) (IF cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_small_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(\<acute>vm_rights,cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc(\<acute>vm_rights);;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI
FI)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> ((\<exists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap (capVPRights_update (\<lambda>_. maskVMRights (capVPRights arch_cap) R) arch_cap))) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))) \<and> ((\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)))
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 2. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (3 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 2. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 3. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q1334 cap_rights_mask cap d v0 v1 v2 v3) (?Q'1334 cap_rights_mask cap d v0 v1 v2 v3) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> ?Q1334 cap_rights_mask cap d v0 v1 v2 v3 s
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> ?Q'1334 cap_rights_mask cap d v0 v1 v2 v3
 4. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 5. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q1334 cap_rights_mask cap d v0 v1 v2 v3) (?G'1341 cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> ?Q1334 cap_rights_mask cap d v0 v1 v2 v3 s
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1341 cap_rights_mask cap d v0 v1 v2 v3 v}
 4. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 5. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q1334 cap_rights_mask cap d v0 v1 v2 v3) (?G'1341 cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q1334 cap_rights_mask cap d v0 v1 v2 v3) (?G'1341 cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> ?Q1334 cap_rights_mask cap d v0 v1 v2 v3 s
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1341 cap_rights_mask cap d v0 v1 v2 v3 v}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q1334 cap_rights_mask cap d v0 v1 v2 v3) (?G'1341 cap_rights_mask cap d v0 v1 v2 v3 (SCAST(32 signed \<rightarrow> 32) cap_frame_cap)) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (?Q1334 cap_rights_mask cap d v0 v1 v2 v3) (?G'1341 cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned) [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> ?Q1334 cap_rights_mask cap d v0 v1 v2 v3 s
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> ?G'1341 cap_rights_mask cap d v0 v1 v2 v3 v}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>v. cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>t. ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) \<longrightarrow> (\<forall>t. ret__unsigned_long_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) \<longrightarrow> cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) && mask 2 = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) \<and> (\<forall>t. vmrights_to_H (ret__unsigned_long_' t) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> ret__unsigned_long_' t && mask 2 = ret__unsigned_long_' t \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = ret__unsigned_long_' t \<longrightarrow> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<and> (\<forall>ta. cap_frame_cap_lift (ret__struct_cap_C_' ta) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' t\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3)) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap), vm_rights_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, ret__struct_cap_C_' := ret__struct_cap_C_' ta, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' ta)))))))}
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3)) (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; Some (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) = map_option cap_to_H (cap_lift cap) \<and> c_valid_cap cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> Some (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3)) = map_option cap_to_H (cap_lift (ret__struct_cap_C_' td)) \<and> c_valid_cap (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; Some (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) = map_option cap_to_H (cap_lift cap) \<and> c_valid_cap cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3) = cap_to_H (Cap_frame_cap (cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>)) \<and> c_valid_cap (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma> x t ta tb tc td. \<lbrakk>ccap_rights_relation R cap_rights_mask; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; Some (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) = map_option cap_to_H (cap_lift cap); c_valid_cap cap\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> d = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> v0 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights v1 R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> v2 = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> v3 = None \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> v0 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights v1 R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> v2 = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> v3 = Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> v0 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights v1 R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> v2 = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> v3 = Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td))
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 \<sigma> x t ta tb tc td x2. \<lbrakk>c_valid_cap cap; ccap_rights_relation R cap_rights_mask; pageSize (cap_to_H x2) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some x2; capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3) = cap_to_H x2\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> d = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> v0 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights v1 R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> v2 = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> v3 = None \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> v0 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights v1 R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> v2 = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> v3 = Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> d = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> v0 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights v1 R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> v2 = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> v3 = Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap), cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td))
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0 \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td))) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)))
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 5. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 6. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 7. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL x9; ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL x9; vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; (case cap_lift (ret__struct_cap_C_' td) of Some (Cap_frame_cap rec) \<Rightarrow> rec) = x9\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> c_valid_cap (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0 \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td))) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)))
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 5. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 6. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 7. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (7 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL x9; ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL x9; vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; (case cap_lift (ret__struct_cap_C_' td) of Some (Cap_frame_cap rec) \<Rightarrow> rec) = x9\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; R = cap_rights_to_H (seL4_CapRights_lift cap_rights_mask); cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0; cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) None\<rbrakk> \<Longrightarrow> c_valid_cap (ret__struct_cap_C_' td)
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0 \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td))) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)))
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 5. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 6. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 7. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; cap_frame_cap_lift (ret__struct_cap_C_' td) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0 \<longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) = 0 \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<and> \<not> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td))) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<longrightarrow> to_bool (cap_frame_cap_CL.capFIsDevice_CL x9) = to_bool (cap_frame_cap_CL.capFIsDevice_CL (cap_frame_cap_lift cap)) \<and> cap_frame_cap_CL.capFBasePtr_CL x9 = cap_frame_cap_CL.capFBasePtr_CL (cap_frame_cap_lift cap) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> framesize_to_H (capFSize_CL x9) = framesize_to_H (capFSize_CL (cap_frame_cap_lift cap)) \<and> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9 = (cap_frame_cap_CL.capFMappedASIDHigh_CL (cap_frame_cap_lift cap) << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL (cap_frame_cap_lift cap) \<and> cap_frame_cap_CL.capFMappedAddress_CL x9 = cap_frame_cap_CL.capFMappedAddress_CL (cap_frame_cap_lift cap) \<and> c_valid_cap (ret__struct_cap_C_' td)))
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL x9; ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL x9; vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; (case cap_lift (ret__struct_cap_C_' td) of Some (Cap_frame_cap rec) \<Rightarrow> rec) = x9\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; ccap_rights_relation R cap_rights_mask; 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0 \<longrightarrow> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> c_valid_cap (ret__struct_cap_C_' td) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> c_valid_cap (ret__struct_cap_C_' td))) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> c_valid_cap (ret__struct_cap_C_' td)) \<and> maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) R = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> c_valid_cap (ret__struct_cap_C_' td))
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td x9. \<lbrakk>(\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL x9; ret__unsigned_long_' ta = cap_frame_cap_CL.capFVMRights_CL x9; vmrights_to_H (ret__unsigned_long_' tb) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tb && mask 2 = ret__unsigned_long_' tb; ret__unsigned_long_' tc = ret__unsigned_long_' tb; (case cap_lift (ret__struct_cap_C_' td) of Some (Cap_frame_cap rec) \<Rightarrow> rec) = x9\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tb\<rparr>; cap_get_tag (ret__struct_cap_C_' td) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_lift cap = Some (Cap_frame_cap x9); c_valid_cap cap; R = cap_rights_to_H (seL4_CapRights_lift cap_rights_mask); 0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<or> 0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9; arch_cap = arch_capability.PageCap (to_bool (cap_frame_cap_CL.capFIsDevice_CL x9)) (cap_frame_cap_CL.capFBasePtr_CL x9) (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL x9)) (framesize_to_H (capFSize_CL x9)) (Some ((cap_frame_cap_CL.capFMappedASIDHigh_CL x9 << local.asid_low_bits) + cap_frame_cap_CL.capFMappedASIDLow_CL x9, cap_frame_cap_CL.capFMappedAddress_CL x9))\<rbrakk> \<Longrightarrow> (cap_frame_cap_CL.capFMappedASIDHigh_CL x9 = 0 \<and> cap_frame_cap_CL.capFMappedASIDLow_CL x9 = 0 \<longrightarrow> c_valid_cap (ret__struct_cap_C_' td)) \<and> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> c_valid_cap (ret__struct_cap_C_' td) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> c_valid_cap (ret__struct_cap_C_' td))) \<and> (0 < cap_frame_cap_CL.capFMappedASIDLow_CL x9 \<longrightarrow> (0 < cap_frame_cap_CL.capFMappedASIDHigh_CL x9 \<longrightarrow> c_valid_cap (ret__struct_cap_C_' td)) \<and> c_valid_cap (ret__struct_cap_C_' td))
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 4. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 5. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (5 subgoals):
 1. \<And>cap_rights_mask cap d v0 v1 v2 v3 ret__unsigned. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; ret__unsigned = cap_get_tag cap; cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>_. True) UNIV [SKIP] (return (capability.ArchObjectCap (arch_capability.PageCap d v0 (maskVMRights v1 R) v2 v3))) (IF ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 2. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; True\<rbrakk> \<Longrightarrow> True
 3. \<And>cap_rights_mask cap d v0 v1 v2 v3 s. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) cap; pageSize (capability.ArchObjectCap (arch_capability.PageCap d v0 v1 v2 v3)) \<noteq> Wellformed_C.ARMSmallPage; arch_cap = arch_capability.PageCap d v0 v1 v2 v3; s \<in> UNIV\<rbrakk> \<Longrightarrow> s \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}
 4. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (\<exists>d ref rghts sz data. arch_cap = arch_capability.PageCap d ref rghts sz data) \<longrightarrow> pageSize (capability.ArchObjectCap arch_cap) \<noteq> Wellformed_C.ARMSmallPage\<rbrakk> \<Longrightarrow> (\<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3) \<longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 5. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<nexists>d v0 v1 v2 v3. arch_cap = arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (Cond {} (lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_small_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_small_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_') (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI))
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> ccorres ccap_relation ret__struct_cap_C_' (\<lambda>a. True) UNIV [SKIP] (return (capability.ArchObjectCap arch_cap)) (\<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__unsigned :== CALL cap_get_capType_'proc(cap);;
IF \<acute>ret__unsigned = SCAST(32 signed \<rightarrow> 32) cap_frame_cap THEN
  lvar_nondet_init vm_rights_' vm_rights_'_update;;
\<acute>ret__unsigned :== CALL cap_frame_cap_get_capFVMRights_'proc(cap);;
\<acute>vm_rights :== CALL vmRightsFromWord_'proc(\<acute>ret__unsigned);;
\<acute>vm_rights :== CALL maskVMRights_'proc(cap_rights_mask);;
\<acute>ret__unsigned_long :== CALL wordFromVMRights_'proc();;
\<acute>ret__struct_cap_C :== CALL cap_frame_cap_set_capFVMRights_'proc(cap,\<acute>ret__unsigned_long);;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
ELSE
  return_C ret__struct_cap_C_'_update (\<lambda>s. cap)
FI {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap arch_cap) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' s)}
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap \<sigma>. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. ret__unsigned_' t = cap_get_tag cap \<longrightarrow> (cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<forall>t. ret__unsigned_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) \<longrightarrow> (\<forall>t. ret__unsigned_long_' t = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) \<longrightarrow> cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) && mask 2 = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap) \<and> (\<forall>t. vmrights_to_H (ret__unsigned_long_' t) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)) \<and> ret__unsigned_long_' t && mask 2 = ret__unsigned_long_' t \<longrightarrow> (\<forall>ta. ret__unsigned_long_' ta = ret__unsigned_long_' t \<longrightarrow> (\<forall>ta. cap_frame_cap_lift (ret__struct_cap_C_' ta) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' t\<rparr> \<and> cap_get_tag (ret__struct_cap_C_' ta) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap arch_cap) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap), vm_rights_' := ret__unsigned_long_' t, ret__unsigned_long_' := ret__unsigned_long_' t, ret__struct_cap_C_' := ret__struct_cap_C_' ta, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv (ret__struct_cap_C_' ta)))))))) \<and> (cap_get_tag cap \<noteq> SCAST(32 signed \<rightarrow> 32) cap_frame_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (return (capability.ArchObjectCap arch_cap) \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_' := cap_get_tag cap, ret__struct_cap_C_' := cap, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation rv cap))}
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (2 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td te. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; ret__unsigned_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' tb = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tc) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tc && mask 2 = ret__unsigned_long_' tc; ret__unsigned_long_' td = ret__unsigned_long_' tc; cap_frame_cap_lift (ret__struct_cap_C_' te) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tc\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap arch_cap) (ret__struct_cap_C_' te)
 2. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV} proof (prove)
goal (6 subgoals):
 1. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td te x11 x12. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; ret__unsigned_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' tb = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tc) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tc && mask 2 = ret__unsigned_long_' tc; ret__unsigned_long_' td = ret__unsigned_long_' tc; cap_frame_cap_lift (ret__struct_cap_C_' te) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tc\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; arch_cap = arch_capability.ASIDPoolCap x11 x12\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap arch_cap) (ret__struct_cap_C_' te)
 2. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td te. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; ret__unsigned_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' tb = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tc) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tc && mask 2 = ret__unsigned_long_' tc; ret__unsigned_long_' td = ret__unsigned_long_' tc; cap_frame_cap_lift (ret__struct_cap_C_' te) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tc\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; arch_cap = arch_capability.ASIDControlCap\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap arch_cap) (ret__struct_cap_C_' te)
 3. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td te x31 x32 x33 x34 x35. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; ret__unsigned_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' tb = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tc) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tc && mask 2 = ret__unsigned_long_' tc; ret__unsigned_long_' td = ret__unsigned_long_' tc; cap_frame_cap_lift (ret__struct_cap_C_' te) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tc\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; arch_cap = arch_capability.PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap arch_cap) (ret__struct_cap_C_' te)
 4. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td te x41 x42. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; ret__unsigned_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' tb = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tc) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tc && mask 2 = ret__unsigned_long_' tc; ret__unsigned_long_' td = ret__unsigned_long_' tc; cap_frame_cap_lift (ret__struct_cap_C_' te) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tc\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; arch_cap = arch_capability.PageTableCap x41 x42\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap arch_cap) (ret__struct_cap_C_' te)
 5. \<And>cap_rights_mask cap \<sigma> x t ta tb tc td te x51 x52. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; \<forall>d v0 v1 v2 v3. arch_cap \<noteq> arch_capability.PageCap d v0 v1 v2 v3; (\<sigma>, x) \<in> rf_sr; ret__unsigned_' t = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; ret__unsigned_' ta = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); ret__unsigned_long_' tb = cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap); vmrights_to_H (ret__unsigned_long_' tc) = maskVMRights (vmrights_to_H (cap_frame_cap_CL.capFVMRights_CL (cap_frame_cap_lift cap))) (cap_rights_to_H (seL4_CapRights_lift cap_rights_mask)); ret__unsigned_long_' tc && mask 2 = ret__unsigned_long_' tc; ret__unsigned_long_' td = ret__unsigned_long_' tc; cap_frame_cap_lift (ret__struct_cap_C_' te) = cap_frame_cap_lift cap\<lparr>cap_frame_cap_CL.capFVMRights_CL := ret__unsigned_long_' tc\<rparr>; cap_get_tag (ret__struct_cap_C_' te) = SCAST(32 signed \<rightarrow> 32) cap_frame_cap; arch_cap = arch_capability.PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> ccap_relation (capability.ArchObjectCap arch_cap) (ret__struct_cap_C_' te)
 6. \<And>cap_rights_mask cap s s'. \<lbrakk>ccap_rights_relation R cap_rights_mask; ccap_relation (capability.ArchObjectCap arch_cap) cap; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. \<forall>v. v = cap_get_tag (cap_' (cap_'_update (\<lambda>_. cap) s)) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> UNIV}