theory Syscall_AI

lemma resolve_address_bits_valid_fault:
  "\<lbrace> valid_objs and valid_cap (fst param)\<rbrace>
   resolve_address_bits param
   \<lbrace>\<lambda>_. valid_objs\<rbrace>,
   \<lbrace>\<lambda>f s. valid_fault (ExceptionTypes_A.fault.CapFault x y f)\<rbrace>" unfolding resolve_address_bits_def proof (induct param rule: resolve_address_bits'.induct) case (1 cap cref) show ?case apply (clarsimp simp: validE_R_def validE_def valid_def  split: sum.split) apply (subst (asm) resolve_address_bits'.simps) apply (split cap.splits) defer 6  (* cnode *)
               apply (simp_all add: spec_validE_def validE_def valid_def
                         throwError_def return_def valid_fault_def)[11] apply (simp only: split: cap.splits if_split_asm) apply (simp add: fail_def) apply (simp only: K_bind_def in_bindE) apply (elim conjE exE disjE) apply ((clarsimp simp: whenE_def bindE_def bind_def lift_def liftE_def
                    throwError_def returnOk_def return_def valid_fault_def
                    valid_cap_def2 wellformed_cap_def word_bits_def
                  split: if_split_asm cap.splits)+)[4] apply (split if_split_asm) apply (clarsimp simp: whenE_def bindE_def bind_def lift_def liftE_def
                throwError_def returnOk_def return_def valid_fault_def
                valid_cap_def2 wellformed_cap_def
              split: if_split_asm cap.splits) apply (simp only: K_bind_def in_bindE) apply (elim conjE exE disjE) apply (clarsimp simp: whenE_def bindE_def bind_def lift_def liftE_def
                throwError_def returnOk_def return_def valid_fault_def
                valid_cap_def2 wellformed_cap_def
              split: if_split_asm cap.splits) apply (split if_split_asm) apply (frule (8) "1.hyps") apply (clarsimp simp add: validE_def valid_def whenE_def bindE_def
               bind_def lift_def liftE_def throwError_def
               returnOk_def return_def valid_fault_def
             split: if_split_asm cap.splits sum.splits) apply (frule in_inv_by_hoareD [OF get_cap_inv]) apply simp apply (frule (1) post_by_hoare [OF get_cap_valid]) apply (erule_tac x=s in allE, erule impE, simp) apply (drule (1) bspec, clarsimp) apply (clarsimp simp add: returnOk_def return_def) apply (frule in_inv_by_hoareD [OF get_cap_inv]) apply (clarsimp simp: whenE_def bindE_def bind_def throwError_def
                          returnOk_def return_def
                    split: if_split_asm cap.splits sum.splits) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_objs and valid_cap (fst param)\<rbrace> resolve_address_bits param \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_objs and valid_cap (fst param)\<rbrace> resolve_address_bits' TYPE('a) param \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace> proof (state)
goal (1 subgoal):
 1. \<And>z cap cref. (\<And>x61 x62 x63 v s s' rv st rva sta rvb stb rvc stc. \<lbrakk>cap = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr v, s') \<in> fst (whenE (\<not> x63 \<le> cref) (throwError $ GuardMismatch (length cref) x63) s); (Inr rv, st) \<in> fst (whenE (length cref < x62 + length x63) (throwError $ DepthMismatch (length cref) (x62 + length x63)) s'); (Inr rva, sta) \<in> fst ((returnOk $ take x62 (drop (length x63) cref)) st); (Inr rvb, stb) \<in> fst ((returnOk $ drop (x62 + length x63) cref) sta); rvb \<noteq> []; (Inr rvc, stc) \<in> fst ((liftE $ get_cap (x61, rva)) stb); is_cnode_cap rvc\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (rvc, rvb))\<rbrace> resolve_address_bits' z (rvc, rvb) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace>) \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (cap, cref))\<rbrace> resolve_address_bits' z (cap, cref) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace> proof (state)
this:
\<lbrakk>cref = CNodeCap ?x61.0 ?x62.0 ?x63.0; ?x62.0 + length ?x63.0 \<noteq> 0; (Inr ?v, ?s') \<in> fst (whenE (\<not> ?x63.0 \<le> cref_) (throwError $ GuardMismatch (length cref_) ?x63.0) ?s); (Inr ?rv, ?st) \<in> fst (whenE (length cref_ < ?x62.0 + length ?x63.0) (throwError $ DepthMismatch (length cref_) (?x62.0 + length ?x63.0)) ?s'); (Inr ?rva, ?sta) \<in> fst ((returnOk $ take ?x62.0 (drop (length ?x63.0) cref_)) ?st); (Inr ?rvb, ?stb) \<in> fst ((returnOk $ drop (?x62.0 + length ?x63.0) cref_) ?sta); ?rvb \<noteq> []; (Inr ?rvc, ?stc) \<in> fst ((liftE $ get_cap (?x61.0, ?rva)) ?stb); is_cnode_cap ?rvc\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (?rvc, ?rvb))\<rbrace> resolve_address_bits' cap (?rvc, ?rvb) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace>

goal (1 subgoal):
 1. \<And>z cap cref. (\<And>x61 x62 x63 v s s' rv st rva sta rvb stb rvc stc. \<lbrakk>cap = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr v, s') \<in> fst (whenE (\<not> x63 \<le> cref) (throwError $ GuardMismatch (length cref) x63) s); (Inr rv, st) \<in> fst (whenE (length cref < x62 + length x63) (throwError $ DepthMismatch (length cref) (x62 + length x63)) s'); (Inr rva, sta) \<in> fst ((returnOk $ take x62 (drop (length x63) cref)) st); (Inr rvb, stb) \<in> fst ((returnOk $ drop (x62 + length x63) cref) sta); rvb \<noteq> []; (Inr rvc, stc) \<in> fst ((liftE $ get_cap (x61, rva)) stb); is_cnode_cap rvc\<rbrakk> \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (rvc, rvb))\<rbrace> resolve_address_bits' z (rvc, rvb) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace>) \<Longrightarrow> \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (cap, cref))\<rbrace> resolve_address_bits' z (cap, cref) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (cref, cref_))\<rbrace> resolve_address_bits' cap (cref, cref_) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s a b. \<lbrakk>(a, b) \<in> fst (resolve_address_bits' cap (cref, cref_) s); valid_objs s; s \<turnstile> cref\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b. \<lbrakk>(a, b) \<in> fst ((case cref of CNodeCap oref radix_bits guard \<Rightarrow> if radix_bits + length guard = 0 then fail else doE whenE (\<not> guard \<le> cref_) (throwError $ GuardMismatch (length cref_) guard);
whenE (length cref_ < radix_bits + length guard) (throwError $ DepthMismatch (length cref_) (radix_bits + length guard));
offset <- returnOk $ take radix_bits (drop (length guard) cref_);
rest <- returnOk $ drop (radix_bits + length guard) cref_;
if rest = [] then returnOk ((oref, offset), []) else doE next_cap <- liftE $ get_cap (oref, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((oref, offset), rest)
odE
odE | _ \<Rightarrow> throwError InvalidRoot) s); valid_objs s; s \<turnstile> cref\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (12 subgoals):
 1. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = NullCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x21 x22 x23 x24. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = UntypedCap x21 x22 x23 x24; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 3. \<And>s a b x31 x32 x33. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = EndpointCap x31 x32 x33; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 4. \<And>s a b x41 x42 x43. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = NotificationCap x41 x42 x43; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 5. \<And>s a b x51 x52 x53. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = ReplyCap x51 x52 x53; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 6. \<And>s a b x61 x62 x63. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = CNodeCap x61 x62 x63; (a, b) \<in> fst ((if x62 + length x63 = 0 then fail else doE whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63);
whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63));
offset <- returnOk $ take x62 (drop (length x63) cref_);
rest <- returnOk $ drop (x62 + length x63) cref_;
if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE
odE) s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 7. \<And>s a b x7. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = ThreadCap x7; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 8. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = DomainCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 9. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = IRQControlCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 10. \<And>s a b x10. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = IRQHandlerCap x10; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = NullCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x21 x22 x23 x24. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = UntypedCap x21 x22 x23 x24; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 3. \<And>s a b x31 x32 x33. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = EndpointCap x31 x32 x33; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 4. \<And>s a b x41 x42 x43. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = NotificationCap x41 x42 x43; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 5. \<And>s a b x51 x52 x53. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = ReplyCap x51 x52 x53; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 6. \<And>s a b x7. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = ThreadCap x7; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 7. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = DomainCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 8. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = IRQControlCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 9. \<And>s a b x10. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = IRQHandlerCap x10; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 10. \<And>s a b x111 x112 x113. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = Zombie x111 x112 x113; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = NullCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x21 x22 x23 x24. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = UntypedCap x21 x22 x23 x24; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 3. \<And>s a b x31 x32 x33. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = EndpointCap x31 x32 x33; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 4. \<And>s a b x41 x42 x43. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = NotificationCap x41 x42 x43; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 5. \<And>s a b x51 x52 x53. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = ReplyCap x51 x52 x53; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 6. \<And>s a b x7. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = ThreadCap x7; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 7. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = DomainCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 8. \<And>s a b. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = IRQControlCap; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 9. \<And>s a b x10. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = IRQHandlerCap x10; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 10. \<And>s a b x111 x112 x113. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = Zombie x111 x112 x113; (a, b) \<in> fst (throwError InvalidRoot s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
A total of 12 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63. \<lbrakk>valid_objs s; s \<turnstile> cref; cref = CNodeCap x61 x62 x63; (a, b) \<in> fst ((if x62 + length x63 = 0 then fail else doE whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63);
whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63));
offset <- returnOk $ take x62 (drop (length x63) cref_);
rest <- returnOk $ drop (x62 + length x63) cref_;
if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE
odE) s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 = 0; (a, b) \<in> fst (fail s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (a, b) \<in> fst ((doE whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63);
whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63));
offset <- returnOk $ take x62 (drop (length x63) cref_);
rest <- returnOk $ drop (x62 + length x63) cref_;
if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE
odE) s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (a, b) \<in> fst ((doE whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63);
whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63));
offset <- returnOk $ take x62 (drop (length x63) cref_);
rest <- returnOk $ drop (x62 + length x63) cref_;
if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE
odE) s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (\<exists>ex. a = Inl ex \<and> (Inl ex, b) \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s)) \<or> (\<exists>y s''. ((\<exists>ex. a = Inl ex \<and> (Inl ex, b) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s'')) \<or> (\<exists>y s''a. ((\<exists>ex. a = Inl ex \<and> (Inl ex, b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a)) \<or> (\<exists>offset s''. ((\<exists>ex. a = Inl ex \<and> (Inl ex, b) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s'')) \<or> (\<exists>rest s''a. (a, b) \<in> fst ((if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE) s''a) \<and> (Inr rest, s''a) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''))) \<and> (Inr offset, s'') \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a))) \<and> (Inr y, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''))) \<and> (Inr y, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s))\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (5 subgoals):
 1. \<And>s a b x61 x62 x63 ex. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; a = Inl ex; (Inl ex, b) \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' ex. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); a = Inl ex; (Inl ex, b) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s'')\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 3. \<And>s a b x61 x62 x63 ya s'' yaa s''a ex. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); a = Inl ex; (Inl ex, b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 4. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b ex. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); a = Inl ex; (Inl ex, b) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 5. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); (a, b) \<in> fst ((if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); (a, b) \<in> fst ((if rest = [] then returnOk ((x61, offset), []) else doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest = []; (a, b) \<in> fst (returnOk ((x61, offset), []) s''c)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; (a, b) \<in> fst ((doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE) s''c)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; (a, b) \<in> fst ((doE next_cap <- liftE $ get_cap (x61, offset);
if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)
odE) s''c)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; (\<exists>ex. a = Inl ex \<and> (Inl ex, b) \<in> fst ((liftE $ get_cap (x61, offset)) s''c)) \<or> (\<exists>next_cap s''. (a, b) \<in> fst ((if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)) s'') \<and> (Inr next_cap, s'') \<in> fst ((liftE $ get_cap (x61, offset)) s''c))\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c ex. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; a = Inl ex; (Inl ex, b) \<in> fst ((liftE $ get_cap (x61, offset)) s''c)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; (a, b) \<in> fst ((if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)) s''d); (Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; (a, b) \<in> fst ((if is_cnode_cap next_cap then resolve_address_bits' cap (next_cap, rest) else returnOk ((x61, offset), rest)) s''d); (Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; is_cnode_cap next_cap; (a, b) \<in> fst (resolve_address_bits' cap (next_cap, rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; is_cnode_cap next_cap; (a, b) \<in> fst (resolve_address_bits' cap (next_cap, rest) s''d); \<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (next_cap, rest))\<rbrace> resolve_address_bits' cap (next_cap, rest) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace>\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 s''d aa. \<lbrakk>\<forall>s. valid_objs s \<and> s \<turnstile> aa \<longrightarrow> (\<forall>x\<in>fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s). case x of (r, s') \<Rightarrow> (\<forall>x1. r = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<forall>a b ba. r \<noteq> Inr ((a, b), ba)) \<or> valid_objs s')); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; x63 \<le> cref_; \<not> length cref_ \<le> x62 + length x63; is_cnode_cap aa; (a, b) \<in> fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s''d); (aa, s''d) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 s''d aa. \<lbrakk>\<forall>s. valid_objs s \<and> s \<turnstile> aa \<longrightarrow> (\<forall>x\<in>fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s). case x of (r, s') \<Rightarrow> (\<forall>x1. r = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<forall>a b ba. r \<noteq> Inr ((a, b), ba)) \<or> valid_objs s')); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; x63 \<le> cref_; \<not> length cref_ \<le> x62 + length x63; is_cnode_cap aa; (a, b) \<in> fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s''d); (aa, s''d) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s); s''d = s\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 s''d aa. \<lbrakk>\<forall>s. valid_objs s \<and> s \<turnstile> aa \<longrightarrow> (\<forall>x\<in>fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s). case x of (r, s') \<Rightarrow> (\<forall>x1. r = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<forall>a b ba. r \<noteq> Inr ((a, b), ba)) \<or> valid_objs s')); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; x63 \<le> cref_; \<not> length cref_ \<le> x62 + length x63; is_cnode_cap aa; (a, b) \<in> fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s); (aa, s) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s); s''d = s\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 s''d aa. \<lbrakk>\<forall>s. valid_objs s \<and> s \<turnstile> aa \<longrightarrow> (\<forall>x\<in>fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s). case x of (r, s') \<Rightarrow> (\<forall>x1. r = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<forall>a b ba. r \<noteq> Inr ((a, b), ba)) \<or> valid_objs s')); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; x63 \<le> cref_; \<not> length cref_ \<le> x62 + length x63; is_cnode_cap aa; (a, b) \<in> fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s); (aa, s) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s); s''d = s; s \<turnstile> aa\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (2 subgoals):
 1. \<And>s a b x61 x62 x63 s''d aa. \<lbrakk>valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; x63 \<le> cref_; \<not> length cref_ \<le> x62 + length x63; is_cnode_cap aa; (a, b) \<in> fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s); (aa, s) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s); s''d = s; s \<turnstile> aa; \<forall>x\<in>fst (resolve_address_bits' cap (aa, drop (x62 + length x63) cref_) s). case x of (r, s') \<Rightarrow> (\<forall>x1. r = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<forall>a b ba. r \<noteq> Inr ((a, b), ba)) \<or> valid_objs s')\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> (\<forall>n g. x1 = GuardMismatch n g \<longrightarrow> length g \<le> word_bits)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b)
 2. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s a b x61 x62 x63 ya s'' yaa s''a offset s''b rest s''c next_cap s''d. \<lbrakk>(Inr next_cap, s''d) \<in> fst ((liftE $ get_cap (x61, offset)) s''c); (Inr rest, s''c) \<in> fst ((returnOk $ drop (x62 + length x63) cref_) s''b); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; x62 + length x63 \<noteq> 0; (Inr ya, s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError $ GuardMismatch (length cref_) x63) s); (Inr yaa, s''a) \<in> fst (whenE (length cref_ < x62 + length x63) (throwError $ DepthMismatch (length cref_) (x62 + length x63)) s''); (Inr offset, s''b) \<in> fst ((returnOk $ take x62 (drop (length x63) cref_)) s''a); rest \<noteq> []; \<not> is_cnode_cap next_cap; (a, b) \<in> fst (returnOk ((x61, offset), rest) s''d)\<rbrakk> \<Longrightarrow> (\<forall>x1. a = Inl x1 \<longrightarrow> valid_fault (CapFault x y x1)) \<and> ((\<exists>aa b ba. a = Inr ((aa, b), ba)) \<longrightarrow> valid_objs b) proof (prove)
goal (1 subgoal):
 1. \<And>s b x61 x62 x63 s'' s''a next_cap. \<lbrakk>(next_cap, b) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s''a); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; (Inr (), s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError (GuardMismatch (length cref_) x63)) s); (Inr (), s''a) \<in> fst (whenE False (throwError (DepthMismatch (length cref_) (x62 + length x63))) s''); \<not> length cref_ \<le> x62 + length x63; \<not> is_cnode_cap next_cap\<rbrakk> \<Longrightarrow> valid_objs b proof (prove)
goal (1 subgoal):
 1. \<And>s b x61 x62 x63 s'' s''a next_cap. \<lbrakk>(next_cap, b) \<in> fst (get_cap (x61, take x62 (drop (length x63) cref_)) s''a); valid_objs s; s \<turnstile> CNodeCap x61 x62 x63; cref = CNodeCap x61 x62 x63; 0 < x62 \<or> x63 \<noteq> []; (Inr (), s'') \<in> fst (whenE (\<not> x63 \<le> cref_) (throwError (GuardMismatch (length cref_) x63)) s); (Inr (), s''a) \<in> fst (whenE False (throwError (DepthMismatch (length cref_) (x62 + length x63))) s''); \<not> length cref_ \<le> x62 + length x63; \<not> is_cnode_cap next_cap; b = s''a\<rbrakk> \<Longrightarrow> valid_objs b proof (prove)
goal:
No subgoals! proof (state)
this:
\<lbrace>valid_objs and (\<lambda>a. a \<turnstile> fst (cref, cref_))\<rbrace> resolve_address_bits' cap (cref, cref_) \<lbrace>\<lambda>_. valid_objs\<rbrace>, \<lbrace>\<lambda>f s. valid_fault (CapFault x y f)\<rbrace>

goal:
No subgoals!