theory ArchUntyped_AI

lemma dui_inv_wf[wp, Untyped_AI_assms]:
  "\<lbrace>invs and cte_wp_at ((=) (cap.UntypedCap dev w sz idx)) slot
     and (\<lambda>s. \<forall>cap \<in> set cs. is_cnode_cap cap
                      \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s))
    and (\<lambda>s. \<forall>x \<in> set cs. s \<turnstile> x)\<rbrace>
     decode_untyped_invocation label args slot (cap.UntypedCap dev w sz idx) cs
   \<lbrace>valid_untyped_inv\<rbrace>,-" proof - have inj: "\<And>node_cap s. \<lbrakk>is_cnode_cap node_cap;
    unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4);valid_cap node_cap s\<rbrakk> \<Longrightarrow>
    inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap))
                      {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}" apply (simp add: comp_def) apply (rule inj_on_split) apply (rule subset_inj_on [OF inj_on_nat_to_cref]) apply (clarsimp simp: is_cap_simps bits_of_def valid_cap_def
                           word_bits_def cap_aligned_def) apply clarsimp apply (rule less_le_trans) apply assumption apply (simp add: le_diff_conv2) done have nasty_strengthen:
    "\<And>S a f s. (\<forall>x\<in>S. cte_wp_at ((=) cap.NullCap) (a, f x) s)
    \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> cap.NullCap) slot s
    \<longrightarrow> slot \<notin> (Pair a \<circ> f) ` S" by (auto simp:cte_wp_at_caps_of_state) show ?thesis apply (simp add: decode_untyped_invocation_def unlessE_def[symmetric]
                     unlessE_whenE
             split del: if_split) apply (rule validE_R_sp[OF whenE_throwError_sp]
                validE_R_sp[OF data_to_obj_type_sp]
                validE_R_sp[OF dui_sp_helper] validE_R_sp[OF map_ensure_empty])+ apply clarsimp apply (rule hoare_pre) apply (wp whenE_throwError_wp[THEN validE_validE_R] check_children_wp
               map_ensure_empty_wp) apply (clarsimp simp: distinct_map cases_imp_eq) apply (subgoal_tac "s \<turnstile> node_cap") prefer 2 apply (erule disjE) apply (drule bspec [where x = "cs ! 0"],clarsimp)+ apply fastforce apply clarsimp apply (clarsimp simp: cte_wp_at_caps_of_state) apply (drule(1) caps_of_state_valid[rotated])+ apply assumption apply (subgoal_tac "\<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s") apply (clarsimp simp: cte_wp_at_caps_of_state) apply (frule(1) caps_of_state_valid[rotated]) apply (clarsimp simp: not_less) apply (frule(2) inj) apply (clarsimp simp: comp_def) apply (frule(1) caps_of_state_valid) apply (simp add: nasty_strengthen[unfolded o_def] cte_wp_at_caps_of_state) apply (intro conjI) apply (intro impI) apply (frule range_cover_stuff[where w=w and rv = 0 and sz = sz], simp_all)[1] apply (clarsimp simp: valid_cap_simps cap_aligned_def)+ apply (frule alignUp_idem[OF is_aligned_weaken,where a = w]) apply (erule range_cover.sz) apply (simp add: range_cover_def) apply (clarsimp simp: get_free_ref_def empty_descendants_range_in) apply (rule conjI[rotated], blast, clarsimp) apply (drule_tac x = "(obj_ref_of node_cap,nat_to_cref (bits_of node_cap) slota)" in bspec) apply (clarsimp simp: is_cap_simps nat_to_cref_def word_bits_def
         bits_of_def valid_cap_simps cap_aligned_def)+ apply (simp add: free_index_of_def) apply (frule(1) range_cover_stuff[where sz = sz]) apply (clarsimp dest!: valid_cap_aligned simp: cap_aligned_def word_bits_def)+ apply simp+ apply (clarsimp simp: get_free_ref_def) apply (erule disjE) apply (drule_tac x= "cs!0" in bspec) subgoal by clarsimp subgoal by simp apply (clarsimp simp: cte_wp_at_caps_of_state ex_cte_cap_wp_to_def) apply (rule_tac x=aa in exI,rule exI,rule exI) apply (rule conjI, assumption) apply simp done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> decode_untyped_invocation label args slot (UntypedCap dev w sz idx) cs \<lbrace>valid_untyped_inv\<rbrace>, - proof (state)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> decode_untyped_invocation label args slot (UntypedCap dev w sz idx) cs \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>node_cap s. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} proof (prove)
goal (1 subgoal):
 1. \<And>node_cap s. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} proof (prove)
goal (1 subgoal):
 1. \<And>node_cap s. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> inj_on (nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} proof (prove)
goal (2 subgoals):
 1. \<And>node_cap s. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> bits_of node_cap < 32
 2. \<And>node_cap s. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<subseteq> {..<2 ^ bits_of node_cap} proof (prove)
goal (1 subgoal):
 1. \<And>node_cap s. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<subseteq> {..<2 ^ bits_of node_cap} proof (prove)
goal (1 subgoal):
 1. \<And>node_cap s x. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap; unat (args ! 4) \<le> x; x < unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> x < 2 ^ bits_of node_cap proof (prove)
goal (2 subgoals):
 1. \<And>node_cap s x. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap; unat (args ! 4) \<le> x; x < unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> x < ?y17 node_cap s x
 2. \<And>node_cap s x. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap; unat (args ! 4) \<le> x; x < unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> ?y17 node_cap s x \<le> 2 ^ bits_of node_cap proof (prove)
goal (1 subgoal):
 1. \<And>node_cap s x. \<lbrakk>is_cnode_cap node_cap; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); s \<turnstile> node_cap; unat (args ! 4) \<le> x; x < unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> unat (args ! 4) + unat (args ! 5) \<le> 2 ^ bits_of node_cap proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrakk>is_cnode_cap ?node_cap; unat (args ! 5) \<le> 2 ^ bits_of ?node_cap - unat (args ! 4); ?s \<turnstile> ?node_cap\<rbrakk> \<Longrightarrow> inj_on (Pair (obj_ref_of ?node_cap) \<circ> nat_to_cref (bits_of ?node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}

goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> decode_untyped_invocation label args slot (UntypedCap dev w sz idx) cs \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>S a f s. \<forall>x\<in>S. cte_wp_at ((=) NullCap) (a, f x) s \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> NullCap) slot s \<longrightarrow> slot \<notin> (Pair a \<circ> f) ` S proof (state)
this:
\<forall>x\<in>?S1. cte_wp_at ((=) NullCap) (?a1, ?f1 x) ?s1 \<Longrightarrow> cte_wp_at (\<lambda>c. c \<noteq> NullCap) slot ?s1 \<longrightarrow> slot \<notin> (Pair ?a1 \<circ> ?f1) ` ?S1

goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> decode_untyped_invocation label args slot (UntypedCap dev w sz idx) cs \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> decode_untyped_invocation label args slot (UntypedCap dev w sz idx) cs \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> doE y <- whenE (gen_invocation_type label \<noteq> UntypedRetype) (throwError IllegalOperation);
y <- whenE (length args < 6) (throwError TruncatedMessage);
y <- whenE (cs = []) (throwError TruncatedMessage);
new_type <- data_to_obj_type (args ! 0);
y <- whenE (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) (throwError (RangeError 0 (word_of_nat untyped_max_bits)));
y <- whenE (new_type = CapTableObject \<and> unat (args ! Suc 0) = 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (new_type = Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) (throwError (InvalidArgument (Suc 0)));
node_cap <- if unat (args ! 3) = 0 then returnOk (cs ! 0) else doE node_slot <- lookup_target_slot (cs ! 0) (to_bl (args ! 2)) (unat (args ! 3));
liftE $ get_cap node_slot
odE;
y <- whenE (\<not> is_cnode_cap node_cap) (throwError (FailedLookup False (MissingCapability (unat (args ! 3)))));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat (args ! 4)) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat (args ! 5) = 0 \<or> unat retypeFanOutLimit < unat (args ! 5)) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat (args ! 5) = 0 \<or> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5)) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat (args ! 4)))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5)) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (Retype slot reset w (alignUp (get_free_ref w (if reset then 0 else free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) dev)
odE \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>y ya yb new_type yc yd ye s. \<not> (new_type = Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) \<and> \<not> (new_type = CapTableObject \<and> unat (args ! Suc 0) = 0) \<and> \<not> (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) \<and> new_type \<noteq> ArchObject ASIDPoolObj \<and> cs \<noteq> [] \<and> \<not> length args < 6 \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) s \<Longrightarrow> valid_objs s
 2. \<And>y ya yb new_type yc yd ye node_cap. \<lbrace>\<lambda>s. (node_cap = cs ! 0 \<or> (\<exists>slot. cte_wp_at ((=) node_cap) slot s)) \<and> \<not> (new_type = Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) \<and> \<not> (new_type = CapTableObject \<and> unat (args ! Suc 0) = 0) \<and> \<not> (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) \<and> new_type \<noteq> ArchObject ASIDPoolObj \<and> cs \<noteq> [] \<and> \<not> length args < 6 \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) s\<rbrace> doE y <- whenE (\<not> is_cnode_cap node_cap) (throwError (FailedLookup False (MissingCapability (unat (args ! 3)))));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat (args ! 4)) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat (args ! 5) = 0 \<or> unat retypeFanOutLimit < unat (args ! 5)) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat (args ! 5) = 0 \<or> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5)) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat (args ! 4)))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5)) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (Retype slot reset w (alignUp (get_free_ref w (if reset then 0 else free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) dev)
odE \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<And>y ya yb new_type yc yd ye node_cap. \<lbrace>\<lambda>s. (node_cap = cs ! 0 \<or> (\<exists>slot. cte_wp_at ((=) node_cap) slot s)) \<and> \<not> (new_type = Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) \<and> \<not> (new_type = CapTableObject \<and> unat (args ! Suc 0) = 0) \<and> \<not> (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) \<and> new_type \<noteq> ArchObject ASIDPoolObj \<and> cs \<noteq> [] \<and> \<not> length args < 6 \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) s\<rbrace> doE y <- whenE (\<not> is_cnode_cap node_cap) (throwError (FailedLookup False (MissingCapability (unat (args ! 3)))));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat (args ! 4)) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat (args ! 5) = 0 \<or> unat retypeFanOutLimit < unat (args ! 5)) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat (args ! 5) = 0 \<or> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5)) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat (args ! 4)))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5)) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (Retype slot reset w (alignUp (get_free_ref w (if reset then 0 else free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) dev)
odE \<lbrace>valid_untyped_inv\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<And>y ya yb new_type yc yd ye node_cap. \<lbrace>?P'38 y ya yb new_type yc yd ye node_cap\<rbrace> doE y <- whenE (\<not> is_cnode_cap node_cap) (throwError (FailedLookup False (MissingCapability (unat (args ! 3)))));
y <- whenE (2 ^ bits_of node_cap - Suc 0 < unat (args ! 4)) (throwError (RangeError 0 (2 ^ bits_of node_cap - 1)));
y <- whenE (unat (args ! 5) = 0 \<or> unat retypeFanOutLimit < unat (args ! 5)) (throwError (RangeError 1 retypeFanOutLimit));
y <- whenE (unat (args ! 5) = 0 \<or> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5)) (throwError (RangeError 1 (word_of_nat (2 ^ bits_of node_cap - unat (args ! 4)))));
y <- mapME_x ensure_empty (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]);
reset <- liftE (const_on_failure False (doE y <- ensure_no_children slot;
returnOk True
odE));
y <- whenE (unat (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5)) (throwError (NotEnoughMemory (2 ^ sz - word_of_nat (if reset then 0 else free_index_of (UntypedCap dev w sz idx)))));
y <- whenE (dev \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Untyped) (throwError (InvalidArgument (Suc 0)));
returnOk (Retype slot reset w (alignUp (get_free_ref w (if reset then 0 else free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) dev)
odE \<lbrace>valid_untyped_inv\<rbrace>, -
 2. \<And>y ya yb new_type yc yd ye node_cap s. (node_cap = cs ! 0 \<or> (\<exists>slot. cte_wp_at ((=) node_cap) slot s)) \<and> \<not> (new_type = Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) \<and> \<not> (new_type = CapTableObject \<and> unat (args ! Suc 0) = 0) \<and> \<not> (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) \<and> new_type \<noteq> ArchObject ASIDPoolObj \<and> cs \<noteq> [] \<and> \<not> length args < 6 \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) s \<Longrightarrow> ?P'38 y ya yb new_type yc yd ye node_cap s proof (prove)
goal (1 subgoal):
 1. \<And>y ya yb new_type yc yd ye node_cap s. (node_cap = cs ! 0 \<or> (\<exists>slot. cte_wp_at ((=) node_cap) slot s)) \<and> \<not> (new_type = Untyped \<and> unat (args ! Suc 0) < untyped_min_bits) \<and> \<not> (new_type = CapTableObject \<and> unat (args ! Suc 0) = 0) \<and> \<not> (unat (args ! Suc 0) < word_bits \<longrightarrow> \<not> obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits) \<and> new_type \<noteq> ArchObject ASIDPoolObj \<and> cs \<noteq> [] \<and> \<not> length args < 6 \<and> \<not> gen_invocation_type label \<noteq> UntypedRetype \<and> (invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)) s \<Longrightarrow> True \<and> (\<not> \<not> is_cnode_cap node_cap \<longrightarrow> True \<and> (\<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4) \<longrightarrow> True \<and> (\<not> (unat (args ! 5) = 0 \<or> unat retypeFanOutLimit < unat (args ! 5)) \<longrightarrow> True \<and> (\<not> (unat (args ! 5) = 0 \<or> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5)) \<longrightarrow> True \<and> ((\<forall>x\<in>set (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]). cte_wp_at ((=) NullCap) x s) \<longrightarrow> (if descendants_of slot (cdt s) = {} then True \<and> (\<not> unat (2 ^ sz - word_of_nat (if True then 0 else free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> True \<and> (\<not> (dev \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Untyped) \<longrightarrow> valid_untyped_inv (Retype slot True w (alignUp (get_free_ref w (if True then 0 else free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) dev) s)) else True \<and> (\<not> unat (2 ^ sz - word_of_nat (if False then 0 else free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> True \<and> (\<not> (dev \<and> \<not> is_frame_type new_type \<and> new_type \<noteq> Untyped) \<longrightarrow> valid_untyped_inv (Retype slot False w (alignUp (get_free_ref w (if False then 0 else free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) new_type (unat (args ! Suc 0)) (map (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) [unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)]) dev) s)))))))) proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; node_cap = cs ! 0\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; node_cap = cs ! 0; is_cnode_cap (cs ! 0) \<longrightarrow> (\<forall>r\<in>cte_refs (cs ! 0) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); s \<turnstile> cs ! 0\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s a b. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s a b. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; caps_of_state s (a, b) = Some node_cap\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s a b. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> UntypedCap dev w sz idx; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> s \<turnstile> node_cap
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sz idx. cte_wp_at (\<lambda>c. c = UntypedCap dev w sz idx) slot s \<and> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> (\<exists>sza idxa. cte_wp_at (\<lambda>c. c = UntypedCap dev w sza idxa) slot s \<and> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sza (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idxa \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sza = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> \<not> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> \<not> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) < unat (args ! 5) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0)) \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; s \<turnstile> UntypedCap dev w sz idx; inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> inj_on (Pair (obj_ref_of node_cap) \<circ> nat_to_cref (bits_of node_cap)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; s \<turnstile> UntypedCap dev w sz idx; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; s \<turnstile> UntypedCap dev w sz idx; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> slot \<notin> (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) ` {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)} \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> (descendants_of slot (cdt s) = {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)) \<and> (descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type))
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) = {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (5 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped\<rbrakk> \<Longrightarrow> sz < word_bits
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped\<rbrakk> \<Longrightarrow> is_aligned w sz
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 4. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 5. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (5 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0\<rbrakk> \<Longrightarrow> ?n172 new_type node_cap s \<le> sz
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0\<rbrakk> \<Longrightarrow> ?n172 new_type node_cap s < LENGTH(32)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (?n172 new_type node_cap s) = w\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 4. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 5. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (4 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0\<rbrakk> \<Longrightarrow> obj_bits_api new_type (unat (args ! Suc 0)) < LENGTH(32)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) = w\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 4. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w; range_cover (alignUp w (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) = w\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> (idx \<le> unat (alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<or> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) = w) \<and> alignUp (get_free_ref w 0) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; range_cover w sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) = w\<rbrakk> \<Longrightarrow> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s slota. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; range_cover w sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) = w; unat (args ! 4) \<le> slota; slota < unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slota) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slota)) (obj_ref_of node_cap) s
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (4 subgoals):
 1. \<And>new_type node_cap s slota. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; range_cover w sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) = w; unat (args ! 4) \<le> slota; slota < unat (args ! 4) + unat (args ! 5)\<rbrakk> \<Longrightarrow> (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slota) \<in> cte_refs node_cap (interrupt_irq_node s)
 2. \<And>new_type node_cap s slota. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; descendants_of slot (cdt s) = {}; unat (args ! 5) \<le> unat (2 ^ sz >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned w sz; range_cover w sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)); sz < word_bits; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; alignUp w (obj_bits_api new_type (unat (args ! Suc 0))) = w; unat (args ! 4) \<le> slota; slota < unat (args ! 4) + unat (args ! 5); ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slota) s\<rbrakk> \<Longrightarrow> ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slota) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slota)) (obj_ref_of node_cap) s
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some node_cap); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; unat (args ! 4) \<le> 2 ^ bits_of node_cap - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits_of node_cap - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s; inj_on (\<lambda>x. (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x)) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; s \<turnstile> UntypedCap dev w sz idx\<rbrakk> \<Longrightarrow> descendants_of slot (cdt s) \<noteq> {} \<longrightarrow> unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))) \<longrightarrow> (dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped) \<longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (\<forall>slot\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. ex_cte_cap_wp_to is_cnode_cap (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) slot) s \<and> cap_table_at (length (nat_to_cref (bits_of node_cap) slot)) (obj_ref_of node_cap) s) \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 4. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat (free_index_of (UntypedCap dev w sz idx)) >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w (free_index_of (UntypedCap dev w sz idx))) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (5 subgoals):
 1. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> idx \<le> 2 ^ sz
 2. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> sz < word_bits
 3. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> is_aligned (?w1044 new_type s r bits g) sz
 4. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32; idx \<le> unat (alignUp (?w1044 new_type s r bits g + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0))) - ?w1044 new_type s r bits g) \<and> alignUp (?w1044 new_type s r bits g + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = ?w1044 new_type s r bits g \<and> range_cover (alignUp (?w1044 new_type s r bits g + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 5. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32\<rbrakk> \<Longrightarrow> is_aligned (?w1044 new_type s r bits g) sz
 2. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32; idx \<le> unat (alignUp (?w1044 new_type s r bits g + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0))) - ?w1044 new_type s r bits g) \<and> alignUp (?w1044 new_type s r bits g + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = ?w1044 new_type s r bits g \<and> range_cover (alignUp (?w1044 new_type s r bits g + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 3. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type s r bits g. \<lbrakk>CNodeCap r bits g = cs ! 0 \<or> (\<exists>a b. caps_of_state s (a, b) = Some (CNodeCap r bits g)); new_type = Untyped \<longrightarrow> untyped_min_bits \<le> unat (args ! Suc 0); new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < 32; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; 6 \<le> length args; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. (\<exists>r bits g. cap = CNodeCap r bits g) \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; unat (args ! 4) \<le> 2 ^ bits - Suc 0; 0 < unat (args ! 5); unat (args ! 5) \<le> unat retypeFanOutLimit; unat (args ! 5) \<le> 2 ^ bits - unat (args ! 4); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (r, drop (32 - bits) (to_bl (word_of_nat x))) = Some NullCap; \<forall>y. length y = bits \<longrightarrow> ex_cte_cap_wp_to is_cnode_cap (r, y) s; inj_on (\<lambda>x. (r, drop (32 - bits) (to_bl (word_of_nat x)))) {unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}; is_aligned w sz; sz < 32; valid_untyped (UntypedCap dev w sz idx) s; untyped_min_bits \<le> sz; idx \<le> 2 ^ sz; w \<noteq> 0; descendants_of slot (cdt s) \<noteq> {}; unat (args ! 5) \<le> unat (2 ^ sz - word_of_nat idx >> obj_bits_api new_type (unat (args ! Suc 0))); dev \<longrightarrow> is_frame_type new_type \<or> new_type = Untyped; is_aligned r (cte_level_bits + bits); cte_level_bits + bits < 32; cap_table_at bits r s; 0 < bits; length g \<le> 32; idx \<le> unat (alignUp (w + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (w + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> range_cover (alignUp (w + word_of_nat idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5))\<rbrakk> \<Longrightarrow> range_cover (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0)))) sz (obj_bits_api new_type (unat (args ! Suc 0))) (unat (args ! 5)) \<and> idx \<le> unat (alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) - w) \<and> alignUp (get_free_ref w idx) (obj_bits_api new_type (unat (args ! Suc 0))) && ~~ mask sz = w \<and> (dev \<longrightarrow> new_type = Untyped \<or> is_frame_type new_type)
 2. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s. \<lbrakk>node_cap = cs ! 0 \<or> (\<exists>a b. cte_wp_at ((=) node_cap) (a, b) s); new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; node_cap = cs ! 0\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s
 2. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (3 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; node_cap = cs ! 0\<rbrakk> \<Longrightarrow> cs ! 0 \<in> set cs
 2. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; node_cap = cs ! 0; is_cnode_cap (cs ! 0) \<longrightarrow> (\<forall>r\<in>cte_refs (cs ! 0) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s
 3. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>new_type_ = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type_ = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type_ (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type_ \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s_; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s_; \<forall>x\<in>set cs. s_ \<turnstile> x; is_cnode_cap node_cap_; \<not> 2 ^ bits_of node_cap_ - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap_ - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap_, nat_to_cref (bits_of node_cap_) x) s_; s_ \<turnstile> node_cap_; node_cap_ = cs ! 0\<rbrakk> \<Longrightarrow> cs ! 0 \<in> set cs proof (prove)
goal (2 subgoals):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; node_cap = cs ! 0; is_cnode_cap (cs ! 0) \<longrightarrow> (\<forall>r\<in>cte_refs (cs ! 0) (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s
 2. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (1 subgoal):
 1. \<lbrakk>new_type_ = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type_ = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type_ (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type_ \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s_; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s_; \<forall>x\<in>set cs. s_ \<turnstile> x; is_cnode_cap node_cap_; \<not> 2 ^ bits_of node_cap_ - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap_ - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap_, nat_to_cref (bits_of node_cap_) x) s_; s_ \<turnstile> node_cap_; node_cap_ = cs ! 0; is_cnode_cap (cs ! 0) \<longrightarrow> (\<forall>r\<in>cte_refs (cs ! 0) (interrupt_irq_node s_). ex_cte_cap_wp_to is_cnode_cap r s_)\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap_ (interrupt_irq_node s_). ex_cte_cap_wp_to is_cnode_cap r s_ proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; cte_wp_at ((=) (UntypedCap dev w sz idx)) slot s; \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. cte_wp_at ((=) NullCap) (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) s; s \<turnstile> node_cap; \<exists>a b. cte_wp_at ((=) node_cap) (a, b) s\<rbrakk> \<Longrightarrow> \<forall>r\<in>cte_refs node_cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s a b aa ba. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_cnode_cap cap \<and> r \<in> cte_refs cap (interrupt_irq_node s)); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; (a, b) \<in> cte_refs node_cap (interrupt_irq_node s); caps_of_state s (aa, ba) = Some node_cap\<rbrakk> \<Longrightarrow> \<exists>aa ba cap. caps_of_state s (aa, ba) = Some cap \<and> is_cnode_cap cap \<and> (a, b) \<in> cte_refs cap (interrupt_irq_node s) proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s a b aa ba. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_cnode_cap cap \<and> r \<in> cte_refs cap (interrupt_irq_node s)); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; (a, b) \<in> cte_refs node_cap (interrupt_irq_node s); caps_of_state s (aa, ba) = Some node_cap\<rbrakk> \<Longrightarrow> caps_of_state s (aa, ?b1069 new_type node_cap s a b aa ba) = Some (?cap1071 new_type node_cap s a b aa ba) \<and> is_cnode_cap (?cap1071 new_type node_cap s a b aa ba) \<and> (a, b) \<in> cte_refs (?cap1071 new_type node_cap s a b aa ba) (interrupt_irq_node s) proof (prove)
goal (1 subgoal):
 1. \<And>new_type node_cap s a b aa ba. \<lbrakk>new_type = Untyped \<longrightarrow> \<not> unat (args ! Suc 0) < untyped_min_bits; new_type = CapTableObject \<longrightarrow> 0 < unat (args ! Suc 0); unat (args ! Suc 0) < word_bits; obj_bits_api new_type (unat (args ! Suc 0)) \<le> untyped_max_bits; new_type \<noteq> ArchObject ASIDPoolObj; cs \<noteq> []; \<not> length args < 6; gen_invocation_type label = UntypedRetype; invs s; caps_of_state s slot = Some (UntypedCap dev w sz idx); \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). \<exists>a b cap. caps_of_state s (a, b) = Some cap \<and> is_cnode_cap cap \<and> r \<in> cte_refs cap (interrupt_irq_node s)); \<forall>x\<in>set cs. s \<turnstile> x; is_cnode_cap node_cap; \<not> 2 ^ bits_of node_cap - Suc 0 < unat (args ! 4); 0 < unat (args ! 5); \<not> unat retypeFanOutLimit < unat (args ! 5); \<not> 2 ^ bits_of node_cap - unat (args ! 4) < unat (args ! 5); \<forall>x\<in>{unat (args ! 4)..<unat (args ! 4) + unat (args ! 5)}. caps_of_state s (obj_ref_of node_cap, nat_to_cref (bits_of node_cap) x) = Some NullCap; s \<turnstile> node_cap; (a, b) \<in> cte_refs node_cap (interrupt_irq_node s); caps_of_state s (aa, ba) = Some node_cap\<rbrakk> \<Longrightarrow> is_cnode_cap node_cap \<and> (a, b) \<in> cte_refs node_cap (interrupt_irq_node s) proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>invs and cte_wp_at ((=) (UntypedCap dev w sz idx)) slot and (\<lambda>s. \<forall>cap\<in>set cs. is_cnode_cap cap \<longrightarrow> (\<forall>r\<in>cte_refs cap (interrupt_irq_node s). ex_cte_cap_wp_to is_cnode_cap r s)) and (\<lambda>s. \<forall>x\<in>set cs. s \<turnstile> x)\<rbrace> decode_untyped_invocation label args slot (UntypedCap dev w sz idx) cs \<lbrace>valid_untyped_inv\<rbrace>, -

goal:
No subgoals!