theory Fastpath_C

lemma lookup_fp_ccorres':
  assumes bits: "bits = size cptr"
  shows
  "ccorres (\<lambda>mcp ccp. ccap_relation (case mcp of Inl v => NullCap | Inr v => v) ccp)
                ret__struct_cap_C_'
           (valid_cap' cap and valid_objs')
           (UNIV \<inter> {s. ccap_relation cap (cap_' s)} \<inter> {s. cptr_' s = cptr}) []
       (cutMon ((=) s) (doE t \<leftarrow> resolveAddressBits cap cptr bits;
                             liftE (getSlotCap (fst t))
                         odE))
       (Call lookup_fp_'proc)" apply (cinit' lift: cptr_') apply (rule ccorres_rhs_assoc2) apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=ret__int_' in ccorres_abstract, ceqv) apply (rule_tac P="rv' = from_bool (isCNodeCap cap)" in ccorres_gen_asm2) apply (simp add: from_bool_0 del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: resolveAddressBits.simps split_def del: Collect_const
                      split del: if_split) apply (rule ccorres_drop_cutMon) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: throwError_def return_def isRight_def isLeft_def
                            ccap_relation_NullCap_iff) apply (clarsimp simp del: Collect_const cong: call_ignore_cong) apply (rule_tac P="valid_cap' cap and valid_objs'"
                and P'="UNIV \<inter> {s. ccap_relation cap (cap_' s) \<and> isCNodeCap cap}
                             \<inter> {s. bits_' s = 32 - of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0}"
                   in ccorres_inst) apply (thin_tac "isCNodeCap cap") defer apply vcg apply (rule conseqPre, vcg) apply clarsimp apply (clarsimp simp: word_size cap_get_tag_isCap bits
                         of_bl_from_bool from_bool_0) proof (induct cap cptr bits arbitrary: s
            rule: resolveAddressBits.induct) case (1 acap acptr abits as) have sub_mask_neq_0_eq:
      "\<And>v :: word32. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (v && 0x1F) && mask 5) = v && 0x1F" apply (subst word_le_mask_eq) apply (simp only: mask_def) apply (rule word_le_minus_mono, simp_all add: word_le_sub1 word_sub_le_iff)[1] apply (rule order_trans, rule word_and_le1, simp) apply (simp add: word_bits_def) done have valid_cnode_bits_0:
      "\<And>s acap. \<lbrakk> isCNodeCap acap; s \<turnstile>' acap \<rbrakk> \<Longrightarrow> capCNodeBits acap \<noteq> 0" by (clarsimp simp: isCap_simps valid_cap'_def) have cap_get_tag_update_1:
      "\<And>f cap. cap_get_tag (cap_C.words_C_update (\<lambda>w. Arrays.update w (Suc 0) (f w)) cap) = cap_get_tag cap" by (simp add: cap_get_tag_def cong: if_cong) show ?case supply if_cong[cong] option.case_cong[cong] apply (cinitlift cap_' bits_') apply (rename_tac cbits ccap) apply (elim conjE) apply (rule_tac F="capCNodePtr_CL (cap_cnode_cap_lift ccap)
                             = capCNodePtr acap
                        \<and> capCNodeGuardSize acap < 32
                        \<and> capCNodeBits acap < 32
                        \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap)
                             = capCNodeGuard acap
                        \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap))
                             = capCNodeGuardSize acap
                        \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))
                             = capCNodeBits acap
                        \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap))
                             = 32 - capCNodeBits acap
                        \<and> unat ((0x20 :: word32) - of_nat abits) = 32 - abits
                        \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)
                                 + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
                             = capCNodeGuardSize acap + capCNodeBits acap"
                   in Corres_UL_C.ccorres_req) apply (clarsimp simp: cap_get_tag_isCap[symmetric]) apply (clarsimp simp: cap_lift_cnode_cap cap_to_H_simps valid_cap'_def
                           capAligned_def cap_cnode_cap_lift_def objBits_simps
                           word_mod_2p_is_mask[where n=5, simplified]
                    elim!: ccap_relationE) apply (simp add: unat_sub[unfolded word_le_nat_alt]
                      unat_of_nat32 word_bits_def) apply (subst unat_plus_simple[symmetric], subst no_olen_add_nat) apply (rule order_le_less_trans, rule add_le_mono) apply (rule word_le_nat_alt[THEN iffD1], rule word_and_le1)+ apply (simp add: mask_def) apply (rule ccorres_guard_imp2) apply csymbr+ apply (rule ccorres_Guard_Seq, csymbr) apply (simp add: resolveAddressBits.simps bindE_assoc extra_sle_sless_unfolds
                      Collect_True
                 split del: if_split del: Collect_const cong: call_ignore_cong) apply (simp add: cutMon_walk_bindE del: Collect_const
                         split del: if_split cong: call_ignore_cong) apply (rule ccorres_drop_cutMon_bindE, rule ccorres_assertE) apply (rule ccorres_cutMon) apply csymbr apply (simp add: locateSlot_conv liftE_bindE cutMon_walk_bind) apply (rule ccorres_drop_cutMon_bind, rule ccorres_stateAssert) apply (rule_tac P="abits < capCNodeBits acap + capCNodeGuardSize acap"
                 in ccorres_case_bools2) apply (rule ccorres_drop_cutMon) apply csymbr+ apply (rule ccorres_symb_exec_r) apply (rule_tac xf'=ret__int_' in ccorres_abstract_all, ceqv) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: unlessE_def split: if_split) apply (simp add: throwError_def return_def cap_tag_defs
                          isRight_def isLeft_def
                          ccap_relation_NullCap_iff
                          in_bindE) apply auto[1] apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_Guard_Seq)+ apply csymbr+ apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_move_array_assertion_cnode_ctes ccorres_move_c_guard_cte
          | csymbr)+ apply (rule ccorres_symb_exec_r) apply ccorres_remove_UNIV_guard apply csymbr+ apply (rule ccorres_cond_false_seq) apply (simp add: ccorres_expand_while_iff_Seq[symmetric]
                           whileAnno_def cong: call_ignore_cong) apply (rule ccorres_cond_false) apply (rule ccorres_cond_true_seq) apply (rule ccorres_from_vcg_split_throws[where P=\<top> and P'=UNIV]) apply vcg apply (rule conseqPre, vcg) apply (clarsimp simp: unlessE_def split: if_split cong: call_ignore_cong) apply (simp add: throwError_def return_def cap_tag_defs isRight_def
                           isLeft_def ccap_relation_NullCap_iff) apply fastforce apply (simp del: Collect_const) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (simp del: Collect_const) apply vcg apply (rule conseqPre, vcg, clarsimp) apply (rule ccorres_cutMon) apply (simp add: cutMon_walk_bindE unlessE_whenE
                 del: Collect_const
                 split del: if_split cong: call_ignore_cong) apply (rule ccorres_drop_cutMon_bindE) apply csymbr+ apply (rule ccorres_rhs_assoc2) apply (rule_tac r'=dc and xf'=xfdc in ccorres_splitE[OF _ ceqv_refl]) apply (rule ccorres_Cond_rhs_Seq) apply (rule ccorres_Guard_Seq)+ apply csymbr apply (simp add: unat_sub word_le_nat_alt if_1_0_0 shiftl_shiftr3 word_size
                     del: Collect_const) apply (rule ccorres_Cond_rhs) apply (rule ccorres_from_vcg_throws[where P=\<top> and P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: whenE_def throwError_def return_def
                                ccap_relation_NullCap_iff isRight_def isLeft_def) apply (simp add: whenE_def) apply (rule ccorres_returnOk_skip) apply simp apply (rule ccorres_cond_false) apply (rule_tac P="valid_cap' acap" in ccorres_from_vcg[where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: valid_cap'_def isCap_simps if_1_0_0) apply (simp add: unat_eq_0[symmetric] whenE_def returnOk_def return_def) apply (rule ccorres_cutMon) apply (simp add: liftE_bindE locateSlot_conv
                   del: Collect_const cong: call_ignore_cong) apply (rule_tac P="abits = capCNodeBits acap + capCNodeGuardSize acap"
                   in ccorres_case_bools2) apply (rule ccorres_drop_cutMon) apply (simp del: Collect_const) apply (simp add: liftE_def getSlotCap_def del: Collect_const) apply (rule ccorres_Guard_Seq)+ apply csymbr+ apply (simp) apply (rule ccorres_move_array_assertion_cnode_ctes
                    ccorres_move_c_guard_cte
                    ccorres_rhs_assoc | csymbr)+ apply (rule getCTE_cap_h_val_ccorres_split) apply ceqv apply (rename_tac "getCTE_cap") apply (csymbr | rule ccorres_Guard_Seq)+ apply (rule ccorres_cond_false_seq) apply (simp add: ccorres_expand_while_iff_Seq[symmetric]
                         whileAnno_def del: Collect_const) apply (rule ccorres_cond_false) apply (rule ccorres_cond_false_seq) apply (simp del: Collect_const) apply (rule_tac P'="{s. cap_' s = getCTE_cap}"
                       in ccorres_from_vcg_throws[where P=\<top>]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: word_sle_def return_def returnOk_def
                              isRight_def) apply (simp add: bind_bindE_assoc
                   del: Collect_const cong: call_ignore_cong if_cong) apply (simp add: liftE_bindE "1.prems" unlessE_def
                        cutMon_walk_bind cnode_cap_case_if
                   del: Collect_const cong: if_cong call_ignore_cong) apply (rule ccorres_Guard_Seq)+ apply csymbr+ apply (simp del: Collect_const cong: call_ignore_cong) apply (rule ccorres_drop_cutMon_bind) apply (rule ccorres_getSlotCap_cte_at) apply (rule ccorres_move_c_guard_cte
                   ccorres_move_array_assertion_cnode_ctes
                 | csymbr)+ apply ctac apply (csymbr | rule ccorres_Guard_Seq)+ apply (rule ccorres_cond_true_seq) apply (rule ccorres_rhs_assoc | csymbr)+ apply (simp add: ccorres_expand_while_iff_Seq[symmetric]
                          whileAnno_def if_to_top_of_bindE bindE_assoc
                          split_def
                    cong: if_cong call_ignore_cong) apply (rule ccorres_cutMon) apply (simp add: cutMon_walk_if cong: call_ignore_cong) apply (rule_tac Q'="\<lambda>s. ret__int_' s = from_bool (isCNodeCap rv)"
                       in ccorres_cond_both'[where Q=\<top>]) apply (clarsimp simp: from_bool_0) apply (rule ccorres_rhs_assoc)+ apply (rule_tac P="ccorres r xf Gd Gd' hs a" for r xf Gd Gd' hs a in rsubst) apply (rule "1.hyps",
                  (rule refl in_returns in_bind[THEN iffD2, OF exI, OF exI, OF conjI]
                       acc_CNodeCap_repr
                        | assumption
                        | clarsimp simp: unlessE_whenE locateSlot_conv
                                         "1.prems"
                        | clarsimp simp: whenE_def[where P=False])+)[1] apply (simp add: whileAnno_def extra_sle_sless_unfolds) apply (rule ccorres_drop_cutMon) apply (simp add: liftE_def getSlotCap_def) apply (rule ccorres_pre_getCTE) apply (rule ccorres_cond_false_seq) apply (rule_tac P="\<lambda>s. cteCap rva = rv" and P'="{s. cap_' s = cap}"
                      in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: return_def returnOk_def word_sle_def isRight_def) apply simp apply (wp getSlotCap_wp) apply (simp add: if_1_0_0) apply vcg apply (wp whenE_throwError_wp) apply (simp add: ccHoarePost_def del: Collect_const) apply vcg apply (clarsimp simp: Collect_const_mem if_1_0_0 of_bl_from_bool
               split del: if_split cong: if_cong) apply (clarsimp simp: cap_get_tag_isCap
                          option.split[where P="\<lambda>x. x"]
                          isCNodeCap_capUntypedPtr_capCNodePtr
                          ) apply (clarsimp simp: word_less_nat_alt word_le_nat_alt linorder_not_less
                    cong: conj_cong) apply (clarsimp simp: word_less_nat_alt word_le_nat_alt linorder_not_less
                    cong: rev_conj_cong) apply (subgoal_tac "\<not> isZombie acap \<and> \<not> isThreadCap acap") prefer 2 apply (clarsimp simp: isCap_simps) apply (simp add: imp_conjL) apply (simp only: all_simps[symmetric] imp_conjL cong: imp_cong,
           simp only: all_simps, simp) apply (simp add: unat_shiftr_le_bound) apply (frule(1) valid_cnode_bits_0, clarsimp) apply (intro conjI impI) apply (simp add: size_of_def) apply (erule (1) valid_cnode_cap_cte_at'') apply simp apply (rule shiftr_less_t2n') apply simp apply simp apply (simp add:size_of_def) apply (erule (1) valid_cnode_cap_cte_at'') apply simp apply (rule shiftr_less_t2n') apply simp apply simp apply (clarsimp simp: cte_wp_at_ctes_of) apply (clarsimp dest!: ctes_of_valid') apply (simp add: cte_level_bits_def size_of_def field_simps) apply (simp add: shiftl_shiftr3 word_size) apply (simp add: word_bw_assocs mask_and_mask min.absorb2) apply (simp_all add: unat_sub word_le_nat_alt unat_eq_0[symmetric]) apply (simp_all add: unat_plus_if' if_P) apply (clarsimp simp: shiftr_over_and_dist
                                 size_of_def cte_level_bits_def field_simps shiftl_shiftl
                                 shiftl_shiftr3 word_size)+ apply (clarsimp simp: unat_gt_0 from_bool_0 trans [OF eq_commute from_bool_eq_if]) apply (intro conjI impI, simp_all)[1] apply (rule word_unat.Rep_inject[THEN iffD1], subst unat_plus_if') apply (simp add: unat_plus_if' unat_of_nat32 word_bits_def) apply (clarsimp simp: shiftr_over_and_dist
                              size_of_def cte_level_bits_def field_simps shiftl_shiftl
                              shiftl_shiftr3 word_size)+ apply (clarsimp simp: unat_gt_0 from_bool_0 trans [OF eq_commute from_bool_eq_if]) apply (intro conjI impI, simp_all)[1] apply (rule word_unat.Rep_inject[THEN iffD1], simp add: unat_of_nat32 word_bits_def) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>cptr = cptr\<rbrace>) [] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (Call lookup_fp_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>cptra. cptra = cptr \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2626 cptra) (?Q'2626 cptra) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>bits :== 0;;
(\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
(IF \<acute>ret__int = 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))))
 2. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2626 cptra s \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (2 subgoals):
 1. \<And>cptra. cptra = cptr \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2626 cptra) (?Q'2626 cptra) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
(IF \<acute>ret__int = 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))))
 2. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2626 cptra s \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. \<And>cptra. cptra = cptr \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2626 cptra) (?Q'2634 cptra) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (IF \<acute>ret__int = 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) (?Q'2634 cptra)
 3. \<And>cptra s. \<lbrakk>cptra = cptr; ?Q2626 cptra s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2626 cptra s \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. \<And>cptra rv'. cptra = cptr \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2626 cptra) (?G'2638 cptra rv') [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (IF rv' = 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> ?G'2638 cptra (ret__int_' s)}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; ?Q2626 cptra s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2626 cptra s \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2626 cptra) (?G'2935 cptra rv') [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (IF rv' = 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptra << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> ?G'2935 cptra (ret__int_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; ?Q2626 cptra s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2626 cptra s \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2626 cptr) (?G'2935 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (IF \<not> isCNodeCap cap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> ?G'2935 cptra (ret__int_' s) \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; ?Q2626 cptra s\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2626 cptra s \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (5 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2946 cptr) (?S2949 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 3. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> ?S2949 cptra (ret__int_' s)) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 4. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> ?Q2946 cptra s) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 5. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> ?Q2946 cptra s) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (5 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = false; \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2946 cptr) (?S2949 cptr false) [SKIP] (cutMon ((=) s) (throwError Fault_H.lookup_failure.InvalidRoot)) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 3. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> ?S2949 cptra (ret__int_' s)) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 4. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> ?Q2946 cptra s) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 5. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> ?Q2946 cptra s) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (5 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = false; \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q2946 cptr) (?S2949 cptr false) [SKIP] (throwError Fault_H.lookup_failure.InvalidRoot) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 3. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> ?S2949 cptra (ret__int_' s)) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 4. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> ?Q2946 cptra s) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 5. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> ?Q2946 cptra s) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (6 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = false; \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'2961 cptr false) \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 2. \<And>cptra rv' \<sigma>. \<lbrakk>cptra = cptr; rv' = false; \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 3. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 4. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> UNIV \<inter> ?R'2961 cptra (ret__int_' s)) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 5. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 6. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (5 subgoals):
 1. \<And>cptra rv' \<sigma>. \<lbrakk>cptra = cptr; rv' = false; \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 2. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 3. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 4. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 5. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (5 subgoals):
 1. \<And>cptra rv' \<sigma>. \<lbrakk>cptra = cptr; rv' = false; \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (throwError Fault_H.lookup_failure.InvalidRoot \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))}
 2. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 3. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 4. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 5. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. \<And>cptra rv'. \<lbrakk>cptra = cptr; rv' = from_bool (isCNodeCap cap); \<not> \<not> isCNodeCap cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr (from_bool (isCNodeCap cap))) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (SKIP;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. isCNodeCap cap \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R2945 cptr) (?T2947 cptr true) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {sa. (\<not> isCNodeCap cap \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> sa \<in> ?T2947 cptra (ret__int_' s))} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> ?R2945 cptra s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. isCNodeCap cap \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {s. (\<not> isCNodeCap cap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 2. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {s. (\<not> isCNodeCap cap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 3. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 4. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)) \<and> s' \<in> ?Q'2626 cptra proof (prove)
goal (4 subgoals):
 1. \<And>cptra. cptra = cptr \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s. s \<in> {s. (\<not> isCNodeCap cap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> s \<in> UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>)} \<inter> \<lbrace>\<^bsup>s\<^esup>ret__int = from_bool (isCNodeCap cap)\<rbrace>}
 2. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?Q'2626 cptra \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 3. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)) \<and> s' \<in> ?Q'2626 cptra
 4. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__int = of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<longrightarrow> (isCNodeCap cap \<longrightarrow> ccap_relation cap \<acute>cap \<and> 0 = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0) \<and> of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = from_bool (isCNodeCap cap)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr}) \<acute>bits :== 0;;
\<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) {s'. (s, s') \<in> rf_sr}
 2. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)) \<and> s' \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__int = of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<longrightarrow> (isCNodeCap cap \<longrightarrow> ccap_relation cap \<acute>cap \<and> 0 = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0) \<and> of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = from_bool (isCNodeCap cap)\<rbrace>
 3. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (3 subgoals):
 1. \<And>cptra s. \<lbrakk>cptra = cptr; (\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)\<rbrakk> \<Longrightarrow> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__int = of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<longrightarrow> (isCNodeCap cap \<longrightarrow> ccap_relation cap \<acute>cap \<and> 0 = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0) \<and> of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = from_bool (isCNodeCap cap)\<rbrace> \<inter> {s'. (s, s') \<in> rf_sr} \<subseteq> {sa. \<forall>t. ret__int_' t = of_bl [cap_get_tag (cap_' sa) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<longrightarrow> (s, sa\<lparr>bits_' := 0, ret__int_' := of_bl [cap_get_tag (cap_' sa) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]\<rparr>) \<in> rf_sr}
 2. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)) \<and> s' \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__int = of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<longrightarrow> (isCNodeCap cap \<longrightarrow> ccap_relation cap \<acute>cap \<and> 0 = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0) \<and> of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = from_bool (isCNodeCap cap)\<rbrace>
 3. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>cptra s s'. \<lbrakk>cptra = cptr; (s, s') \<in> rf_sr; (valid_cap' cap and valid_objs') s; s' \<in> \<lbrace>ccap_relation cap \<acute>cap\<rbrace>\<rbrakk> \<Longrightarrow> ((\<not> isCNodeCap cap \<longrightarrow> True) \<and> (\<not> \<not> isCNodeCap cap \<longrightarrow> (valid_cap' cap and valid_objs') s)) \<and> s' \<in> \<lbrace>\<forall>t. \<^bsup>t\<^esup>ret__int = of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<longrightarrow> (isCNodeCap cap \<longrightarrow> ccap_relation cap \<acute>cap \<and> 0 = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0) \<and> of_bl [cap_get_tag \<acute>cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = from_bool (isCNodeCap cap)\<rbrace>
 2. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' cap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation cap \<acute>cap \<and> isCNodeCap cap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat bits \<and> bits \<le> 32 \<and> bits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits cap cptr bits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== cptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (state)
goal (1 subgoal):
 1. \<And>a b c s. (\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 sa. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' rve and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation rve \<acute>cap \<and> isCNodeCap rve\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat rvd \<and> rvd \<le> 32 \<and> rvd \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) sa) (doE t <- CSpace_H.resolveAddressBits rve b rvd;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))) \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' a and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation a \<acute>cap \<and> isCNodeCap a\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat c \<and> c \<le> 32 \<and> c \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits a b c;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (state)
this:
\<lbrakk>?x2 = acap; isCNodeCap ?x2; (Inr ?v2, ?s'2) \<in> fst (returnOk (capCNodeBits ?x2) ?s2); (Inr ?rv2, ?st2) \<in> fst (returnOk (capCNodeGuardSize ?x2) ?s'2); (Inr ?rva2, ?sta2) \<in> fst (returnOk (?v2 + ?rv2) ?st2); (Inr ?rvb2, ?stb2) \<in> fst (haskell_assertE (?rva2 \<noteq> 0) [] ?sta2); (Inr ?rvba2, ?stc2) \<in> fst (returnOk (fromCPtr acptr `~shiftR~` (abits - ?rva2) && mask ?v2) ?stb2); (Inr ?rvbb2, ?std2) \<in> fst ((withoutFailure $ locateSlotCap ?x2 ?rvba2) ?stc2); (Inr ?rvbc2, ?ste2) \<in> fst (returnOk (fromCPtr acptr `~shiftR~` (abits - ?rv2) && mask ?rv2) ?std2); (Inr ?rvbd2, ?stf2) \<in> fst ((unlessE (?rv2 \<le> abits \<and> ?rvbc2 = capCNodeGuard ?x2) $ throw $ Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard ?x2) ?rv2) ?ste2); (Inr ?rvc2, ?stg2) \<in> fst ((whenE (abits < ?rva2) $ throw $ Fault_H.lookup_failure.DepthMismatch abits ?rva2) ?stf2); (Inr ?rvd2, ?sth2) \<in> fst (returnOk (abits - ?rva2) ?stg2); ?rvd2 \<noteq> 0; (Inr ?rve2, ?sti2) \<in> fst ((withoutFailure $ getSlotCap ?rvbb2) ?sth2); ?rve2 = capability.CNodeCap ?x111.2 ?x112.2 ?x113.2 ?x114.2\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' ?rve2 and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation ?rve2 \<acute>cap \<and> isCNodeCap ?rve2\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat ?rvd2 \<and> ?rvd2 \<le> 32 \<and> ?rvd2 \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) ?sa2) (doE t <- CSpace_H.resolveAddressBits ?rve2 acptr ?rvd2;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))

goal (1 subgoal):
 1. \<And>a b c s. (\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 sa. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' rve and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation rve \<acute>cap \<and> isCNodeCap rve\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat rvd \<and> rvd \<le> 32 \<and> rvd \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) sa) (doE t <- CSpace_H.resolveAddressBits rve b rvd;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))) \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' a and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation a \<acute>cap \<and> isCNodeCap a\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat c \<and> c \<le> 32 \<and> c \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits a b c;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (v && 0x1F) && mask 5) = v && 0x1F proof (prove)
goal (2 subgoals):
 1. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (v && 0x1F) \<le> mask 5
 2. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (v && 0x1F)) = v && 0x1F proof (prove)
goal (2 subgoals):
 1. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (v && 0x1F) \<le> (1 << 5) - 1
 2. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (v && 0x1F)) = v && 0x1F proof (prove)
goal (2 subgoals):
 1. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> v && 0x1F \<le> 0x20
 2. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (v && 0x1F)) = v && 0x1F proof (prove)
goal (1 subgoal):
 1. \<And>v. v && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (v && 0x1F)) = v && 0x1F proof (prove)
goal:
No subgoals! proof (state)
this:
?v2 && 0x1F \<noteq> 0 \<Longrightarrow> 0x20 - (0x20 - (?v2 && 0x1F) && mask 5) = ?v2 && 0x1F

goal (1 subgoal):
 1. \<And>a b c s. (\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 sa. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' rve and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation rve \<acute>cap \<and> isCNodeCap rve\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat rvd \<and> rvd \<le> 32 \<and> rvd \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) sa) (doE t <- CSpace_H.resolveAddressBits rve b rvd;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))) \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' a and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation a \<acute>cap \<and> isCNodeCap a\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat c \<and> c \<le> 32 \<and> c \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits a b c;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>s acap. \<lbrakk>isCNodeCap acap; valid_cap' acap s\<rbrakk> \<Longrightarrow> capCNodeBits acap \<noteq> 0 proof (state)
this:
\<lbrakk>isCNodeCap ?acap2; valid_cap' ?acap2 ?s2\<rbrakk> \<Longrightarrow> capCNodeBits ?acap2 \<noteq> 0

goal (1 subgoal):
 1. \<And>a b c s. (\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 sa. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' rve and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation rve \<acute>cap \<and> isCNodeCap rve\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat rvd \<and> rvd \<le> 32 \<and> rvd \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) sa) (doE t <- CSpace_H.resolveAddressBits rve b rvd;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))) \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' a and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation a \<acute>cap \<and> isCNodeCap a\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat c \<and> c \<le> 32 \<and> c \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits a b c;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>f cap. cap_get_tag (cap_C.words_C_update (\<lambda>w. Arrays.update w (Suc 0) (f w)) cap) = cap_get_tag cap proof (state)
this:
cap_get_tag (cap_C.words_C_update (\<lambda>w. Arrays.update w (Suc 0) (?f2 w)) ?cap2) = cap_get_tag ?cap2

goal (1 subgoal):
 1. \<And>a b c s. (\<And>x v s s' rv st rva sta rvb stb rvba stc rvbb std rvbc ste rvbd stf rvc stg rvd sth rve sti x111 x112 x113 x114 sa. \<lbrakk>x = a; isCNodeCap x; (Inr v, s') \<in> fst (returnOk (capCNodeBits x) s); (Inr rv, st) \<in> fst (returnOk (capCNodeGuardSize x) s'); (Inr rva, sta) \<in> fst (returnOk (v + rv) st); (Inr rvb, stb) \<in> fst (haskell_assertE (rva \<noteq> 0) [] sta); (Inr rvba, stc) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rva) && mask v) stb); (Inr rvbb, std) \<in> fst ((withoutFailure $ locateSlotCap x rvba) stc); (Inr rvbc, ste) \<in> fst (returnOk (fromCPtr b `~shiftR~` (c - rv) && mask rv) std); (Inr rvbd, stf) \<in> fst ((unlessE (rv \<le> c \<and> rvbc = capCNodeGuard x) $ throw $ Fault_H.lookup_failure.GuardMismatch c (capCNodeGuard x) rv) ste); (Inr rvc, stg) \<in> fst ((whenE (c < rva) $ throw $ Fault_H.lookup_failure.DepthMismatch c rva) stf); (Inr rvd, sth) \<in> fst (returnOk (c - rva) stg); rvd \<noteq> 0; (Inr rve, sti) \<in> fst ((withoutFailure $ getSlotCap rvbb) sth); rve = capability.CNodeCap x111 x112 x113 x114\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' rve and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation rve \<acute>cap \<and> isCNodeCap rve\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat rvd \<and> rvd \<le> 32 \<and> rvd \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) sa) (doE t <- CSpace_H.resolveAddressBits rve b rvd;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))) \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' a and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation a \<acute>cap \<and> isCNodeCap a\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat c \<and> c \<le> 32 \<and> c \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) s) (doE t <- CSpace_H.resolveAddressBits a b c;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== b << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation acap \<acute>cap \<and> isCNodeCap acap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat abits \<and> abits \<le> 32 \<and> abits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation acap \<acute>cap \<and> isCNodeCap acap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat abits \<and> abits \<le> 32 \<and> abits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>bits cap. \<lbrakk>bits = 0x20 - word_of_nat abits \<and> abits \<le> 32 \<and> abits \<noteq> 0; ccap_relation acap cap \<and> isCNodeCap acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits \<and> abits \<le> 32 \<and> abits \<noteq> 0; ccap_relation acap ccap \<and> isCNodeCap acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap
 2. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_cap' acap s; valid_objs' s\<rbrakk> \<Longrightarrow> capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap
 2. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < word_bits; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> word_bits; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) < 32 \<and> unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32 \<and> unat (0x20 - ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) = 32 - unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) + ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) = unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)
 2. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> 32; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> unat (((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) + ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) = unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)
 2. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> 32; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 2 ^ LENGTH(32)
 2. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (4 subgoals):
 1. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> 32; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> ?j850 ccap s s'
 2. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> 32; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) \<le> ?l850 ccap s s'
 3. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> 32; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> ?j850 ccap s s' + ?l850 ccap s s' < 2 ^ LENGTH(32)
 4. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; valid_objs' s; acap = capability.CNodeCap (cap_C.words_C ccap.[0] && ~~ mask 5) (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)) (cap_C.words_C ccap.[Suc 0] && mask 18) (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)); is_aligned (cap_C.words_C ccap.[0] && ~~ mask 5) (cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)); cteSizeBits + unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) < 32; 0 < unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5); unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5) + unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5) \<le> 32; (cap_C.words_C ccap.[Suc 0] && mask 18) && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 23) && mask 5)) = cap_C.words_C ccap.[Suc 0] && mask 18; \<forall>addr. real_cte_at' ((cap_C.words_C ccap.[0] && ~~ mask 5) + 2 ^ cteSizeBits * (addr && mask (unat ((cap_C.words_C ccap.[Suc 0] >> 18) && mask 5)))) s\<rbrakk> \<Longrightarrow> unat (mask 5) + unat (mask 5) < 2 ^ LENGTH(32)
 2. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (1 subgoal):
 1. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') UNIV [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 cbits ccap) (?Q'861 cbits ccap) [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(ccap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(ccap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> ?Q'861 cbits ccap proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 cbits ccap) (?G'1872 cbits ccap ret__unsigneda ret__unsigned) [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError \<lbrace>cbits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat cbits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if ret__unsigneda \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - ret__unsigneda < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - ret__unsigneda) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - ret__unsigned < 0x20\<rbrace> (Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat ret__unsigneda >> unat (0x20 - ret__unsigned)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (ret__unsigneda + ret__unsigned);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> ?G'1872 cbits ccap v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 cbits ccap) (?G'2519 cbits ccap ret__unsigneda ret__unsigned) [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if ret__unsigneda \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - ret__unsigneda < 0x20\<rbrace> (\<acute>ret__int :== (if acptr << unat cbits >> unat (0x20 - ret__unsigneda) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - ret__unsigned < 0x20\<rbrace> (Guard ShiftError \<lbrace>ret__unsigneda < 0x20\<rbrace> (\<acute>radix :== acptr << unat cbits << unat ret__unsigneda >> unat (0x20 - ret__unsigned)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== cbits + (ret__unsigneda + ret__unsigned);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> ?G'2519 cbits ccap v va} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 (0x20 - word_of_nat abits) ccap) (?G'2519 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) [SKIP] (cutMon ((=) as) (doE x <- assertE (0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap);
x <- liftE (locateSlotCap acap ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
xa <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
xa <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (x, 0) else doE nextCap <- liftE (getSlotCap x);
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (x, abits - (capCNodeBits acap + capCNodeGuardSize acap))
odE;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (Guard ShiftError \<lbrace>capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> ?G'2519 cbits ccap v va} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 (0x20 - word_of_nat abits) ccap) (?G'2519 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) [SKIP] (doE rv <- cutMon ((=) as) (assertE (0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap));
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (assertE (0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap) as)) (doE x <- liftE (locateSlotCap acap ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
xa <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
xa <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (x, 0) else doE nextCap <- liftE (getSlotCap x);
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (x, abits - (capCNodeBits acap + capCNodeGuardSize acap))
odE;
liftE (getSlotCap (fst t))
odE)
odE) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (Guard ShiftError \<lbrace>capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> ?G'2519 cbits ccap v va} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 (0x20 - word_of_nat abits) ccap) (?G'2519 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (assertE (0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap) as)) (doE x <- liftE (locateSlotCap acap ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
xa <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
xa <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (x, 0) else doE nextCap <- liftE (getSlotCap x);
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (x, abits - (capCNodeBits acap + capCNodeGuardSize acap))
odE;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (Guard ShiftError \<lbrace>capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> ?G'2519 cbits ccap v va} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsigned s. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsigned = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE (0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap) as)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 (0x20 - word_of_nat abits) ccap) (?G'2519 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) [SKIP] (cutMon ((=) s) (doE x <- liftE (locateSlotCap acap ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
xa <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
xa <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (x, 0) else doE nextCap <- liftE (getSlotCap x);
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (x, abits - (capCNodeBits acap + capCNodeGuardSize acap))
odE;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(ccap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (Guard ShiftError \<lbrace>capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> ?G'2519 cbits ccap v va} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE (0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap) as); ret__unsigned = capCNodeGuard_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 (0x20 - word_of_nat abits) ccap) (?G'3166 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) ret__unsigned) [SKIP] (cutMon ((=) s) (doE x <- liftE (locateSlotCap acap ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
xa <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
xa <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (x, 0) else doE nextCap <- liftE (getSlotCap x);
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (x, abits - (capCNodeBits acap + capCNodeGuardSize acap))
odE;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== ret__unsigned;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (Guard ShiftError \<lbrace>capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace> (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'3166 cbits ccap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q861 (0x20 - word_of_nat abits) ccap) (?G'3166 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (do rv <- cutMon ((=) s) (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) []);
cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)
od) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q861 cbits ccap s \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'3166 cbits ccap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?P3427 (0x20 - word_of_nat abits) ccap) (?G'3166 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> ?P3427 cbits ccap s) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'3166 cbits ccap v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R3435 (0x20 - word_of_nat abits) ccap) (?S3438 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 3. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R3435 cbits ccap s) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?S3438 cbits ccap v va vb) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R3435 (0x20 - word_of_nat abits) ccap) (?S3438 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 3. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R3435 cbits ccap s) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?S3438 cbits ccap v va vb) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R3435 (0x20 - word_of_nat abits) ccap) (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 3. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R3435 cbits ccap s) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R3435 (0x20 - word_of_nat abits) ccap) (?Q'4191 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI (?Q'4191 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; ?R3435 (0x20 - word_of_nat abits) ccap sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R3435 cbits ccap s) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (\<lambda>a. ?G4200 (0x20 - word_of_nat abits) ccap a rv') (?G'4197 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (IF rv' \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> ?G'4197 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa)}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. ?G4200 (0x20 - word_of_nat abits) ccap sa rv'\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. ?G4200 cbits ccap s rv')) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q4442 (0x20 - word_of_nat abits) ccap rv') (?S4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?S4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa)) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> ?Q4442 (0x20 - word_of_nat abits) ccap rv' sa) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> ?Q4442 cbits ccap rv' s) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'4446 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv' \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> ?R'4446 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa)) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv' \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv' \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ccap s rv' \<sigma>. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>x\<in>fst (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))}) \<and> ((capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>x\<in>fst (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))})
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ccap s rv' \<sigma>. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); abits < capCNodeBits acap + capCNodeGuardSize acap; rv' \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = 0) \<longrightarrow> (\<sigma>, s) \<in> rf_sr}) \<and> ((capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = 0) \<longrightarrow> (\<sigma>, s) \<in> rf_sr})
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<not> rv' \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap rv') (?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv') [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (SKIP;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap 0) (?T4437 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?T4437 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap 0) (?C'4537 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> ?C'4537 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap 0) (?G'5083 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 ret__unsigned) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (Guard MemorySafety \<lbrace>acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr ret__unsigned) (unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (ret__unsigned + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> ?G'5083 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R4440 (0x20 - word_of_nat abits) ccap 0) (?G'5083 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (Guard MemorySafety \<lbrace>acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr (capCNodePtr acap)) (unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> ?G'5083 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 (0x20 - word_of_nat abits) ccap rv' sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ?R4440 cbits ccap rv' s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?Q'5992 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) (?Q'5992 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned rv'a. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?G'5998 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned rv'a) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> ?G'5998 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned ()}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned rv'a. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?G'6515 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned rv'a) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (IF (if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?G'6515 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned ()}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned rv'a. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?R'6614 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned rv'a) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (SKIP;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?R'6614 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned () \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?R'6614 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) ()) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
ELSE
  IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?R'6614 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned () \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?R'6632 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) ()) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?R'6632 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned () \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A5989 (0x20 - word_of_nat abits) ccap 0) (?R'6637 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) ()) [SKIP] (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_';;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?R'6637 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned () \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; ?A5989 (0x20 - word_of_nat abits) ccap 0 sa\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 (0x20 - word_of_nat abits) ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> (?A5989 cbits ccap rv' and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'6642 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) ()) \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},UNIV
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sa. sa \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> UNIV \<inter> ?R'6642 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned () \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 7. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 8. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' UNIV,{s. \<exists>(rv, \<sigma>')\<in>fst ((doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. s \<in> {s. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) s \<in> {s. s\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst ((doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap))
odE) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. s \<in> {s. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) s \<in> {s. s\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ccap s \<sigma>. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>x\<in>fst (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))}) \<and> ((capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>x\<in>fst (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)) \<sigma>). case x of (rv, \<sigma>') \<Rightarrow> (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' t))})
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. s \<in> {s. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) s \<in> {s. s\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ccap s \<sigma>. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = 0) \<longrightarrow> (\<sigma>, s) \<in> rf_sr}) \<and> ((capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) \<longrightarrow> {s. (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. (\<exists>t. cap_get_tag (ret__struct_cap_C_' t) = 0) \<longrightarrow> (\<sigma>, s) \<in> rf_sr})
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. s \<in> {s. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) s \<in> {s. s\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. s \<in> {s. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) s \<in> {s. s\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> UNIV \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> rv'\<rbrace> \<inter> - \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) \<lbrace>0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20\<rbrace>
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?C'5986 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) 0 (capCNodePtr acap) \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {sa. sa \<in> {sb. (ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' sa \<noteq> 0 \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := v\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'5986 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned (ret__int_' sa) v \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc rv' ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; rv' = 0; ret__unsigned = capCNodePtr acap; True\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (\<lbrace>0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20\<rbrace> \<inter> {s'. (sa, s') \<in> rf_sr}) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s'. (sa, s') \<in> rf_sr}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s. s \<in> {sa. (ret__int_' s \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' s \<noteq> 0 \<longrightarrow> sa \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> \<lbrace>0x20 < cbits + (ret__unsigneda + ret__unsignedb) \<and> \<not> cbits + (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s. s \<in> {sa. (ret__int_' s \<noteq> 0 \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>True\<rbrace>) \<and> (\<not> ret__int_' s \<noteq> 0 \<longrightarrow> sa \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> \<lbrace>0x20 < cbits + (ret__unsigneda + ret__unsignedb) \<and> \<not> cbits + (ret__unsigneda + ret__unsignedb) < 0x20\<rbrace> \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))}}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI \<lbrace>\<acute>ret__int = 0 \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20\<rbrace>
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> (?G'4065 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap) \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'4065 cbits ccap v va vb}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; abits < capCNodeBits acap + capCNodeGuardSize acap; \<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) sa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile> ({s. (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0) = 0 \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (\<not> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)} \<inter> {s'. (sa, s') \<in> rf_sr}) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI {s'. (sa, s') \<in> rf_sr}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 3. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon (\<lambda>s'. ((), s') \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (cutMon ((=) sa) (doE x <- unlessE (capCNodeGuardSize acap \<le> abits \<and> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
x <- whenE (abits < capCNodeBits acap + capCNodeGuardSize acap) (throwError (Fault_H.lookup_failure.DepthMismatch abits (capCNodeBits acap + capCNodeGuardSize acap)));
t <- if abits \<le> capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (doE rv <- cutMon ((=) sa) (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))));
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)
odE) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?U3436 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (doE a <- whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)
odE) (\<acute>capGuard :== capCNodeGuard acap;;
(\<acute>ret__int :== (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> ?U3436 cbits ccap v va vb)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?G'7420 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (doE a <- whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)
odE) (IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'7420 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T3434 (0x20 - word_of_nat abits) ccap) (?G'7420 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (doE a <- whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)));
cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)
odE) (IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T3434 cbits ccap s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'7420 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?P7562 (0x20 - word_of_nat abits) ccap) (?P'7555 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (?P7562 cbits ccap and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?P'7555 cbits ccap v va vb \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?Q7568 (0x20 - word_of_nat abits) ccap) (?S7571 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0));;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7568 cbits ccap a) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?S7571 cbits ccap v va vb) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?Q7568 (0x20 - word_of_nat abits) ccap) (?C'7578 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7568 cbits ccap a) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?C'7578 cbits ccap v va vb \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?Q7568 (0x20 - word_of_nat abits) ccap) (?G'7590 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (IF (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7568 cbits ccap a) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> ?G'7590 cbits ccap v va vb} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?Q7568 (0x20 - word_of_nat abits) ccap) (?G'7590 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (IF (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?Q7568 cbits ccap a) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> ?G'7590 cbits ccap v va vb} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?Q7727 (0x20 - word_of_nat abits) ccap) (?S7730 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (\<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7726 (0x20 - word_of_nat abits) ccap) (?T7728 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) SKIP
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> ?Q7727 cbits ccap a) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> ?R7726 cbits ccap a)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> ?S7730 cbits ccap v va vb) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> ?T7728 cbits ccap v va vb)}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) rv (ret__struct_cap_C_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7726 (0x20 - word_of_nat abits) ccap) (?T7728 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) SKIP
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> ?R7726 cbits ccap a)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> ?T7728 cbits ccap v va vb)}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<forall>t. cap_get_tag (ret__struct_cap_C_' t) = SCAST(32 signed \<rightarrow> 32) cap_null_cap \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := ret__struct_cap_C_' t, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) rv (ret__struct_cap_C_' t))}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7726 (0x20 - word_of_nat abits) ccap) (?T7728 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) SKIP
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> ?R7726 cbits ccap a)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> ?T7728 cbits ccap v va vb)}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7726 (0x20 - word_of_nat abits) ccap) (?T7728 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) SKIP
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> ?R7726 cbits ccap a)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> ?T7728 cbits ccap v va vb)}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7726 (0x20 - word_of_nat abits) ccap) (?T7728 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (returnOk ()) SKIP
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> ?R7726 cbits ccap a)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> ?T7728 cbits ccap v va vb)}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); \<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap)))) (SKIP;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> capCNodeGuardSize acap = 0 \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = 0; ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?T7569 (0x20 - word_of_nat abits) ccap 0 (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE (capCNodeGuard acap \<noteq> 0) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) 0))) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?T7569 cbits ccap v va vb)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> capCNodeGuardSize acap = 0 \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = 0; ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> ccorres_underlying rf_sr \<Gamma> (inr_rrel dc) xfdc (inl_rrel (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v))) ret__struct_cap_C_' (?R7567 (0x20 - word_of_nat abits) ccap) (?R'7780 (0x20 - word_of_nat abits) ccap 0 (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) [SKIP] (whenE (capCNodeGuard acap \<noteq> 0) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) 0))) SKIP
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ?R7567 cbits ccap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> ?R'7780 cbits ccap v va vb \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> capCNodeGuardSize acap = 0 \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = 0; ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. valid_cap' acap \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} SKIP {s. \<exists>(rv, \<sigma>')\<in>fst (whenE (capCNodeGuard acap \<noteq> 0) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) 0)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel dc rv (xfdc s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> capCNodeGuardSize acap = 0 \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = 0; ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> {s. valid_cap' acap \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (whenE (capCNodeGuard acap \<noteq> 0) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) 0)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> inr_rrel dc rv (xfdc s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ccap s sa \<sigma> x. \<lbrakk>ccap_relation (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift ccap)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) 0 0) ccap; abits \<le> 32; 0 < unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)); (Inr (), s) \<in> fst (assertE True as); \<not> abits < unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)); ((), sa) \<in> fst (stateAssert (\<lambda>s. case gsCNodes s (capCNodePtr_CL (cap_cnode_cap_lift ccap)) of None \<Rightarrow> False | Some n \<Rightarrow> n = unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> (acptr >> abits - unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 2 ^ n) [] s); capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0; acap = capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift ccap)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) 0 0; capAligned (capability.CNodeCap (capCNodePtr_CL (cap_cnode_cap_lift ccap)) (unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))) 0 0); (\<sigma>, x) \<in> rf_sr; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = 0; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)); unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<le> word_bits; \<forall>addr. real_cte_at' (capCNodePtr_CL (cap_cnode_cap_lift ccap) + 2 ^ cteSizeBits * (addr && mask (unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap))))) \<sigma>\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (whenE False (throwError (Fault_H.lookup_failure.GuardMismatch abits 0 0)) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x) \<in> rf_sr \<and> inr_rrel dc rv (xfdc x)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon (\<lambda>s'. (Inr (), s') \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); dc rv rv'; (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv) (?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q7551 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?Q'7551 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>?Q7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v. ?Q'7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v))),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?S7832 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?S7832 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?S7832 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?S7832 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?S7832 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))))) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?S7832 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?S7832 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)));
return (Inr (cteCap cte))
od) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?S7832 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?C'7856 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)));
return (Inr (cteCap cte))
od) (\<acute>radix :== acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?C'7856 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?G'8402 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' ret__unsigned) [SKIP] (do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)));
return (Inr (cteCap cte))
od) (Guard MemorySafety \<lbrace>acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr ret__unsigned) (unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (ret__unsigned + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> ?G'8402 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R7829 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?G'8402 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) [SKIP] (do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)));
return (Inr (cteCap cte))
od) (Guard MemorySafety \<lbrace>acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr (capCNodePtr acap)) (unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?R7829 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> ?G'8402 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A9308 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?C'9305 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) [SKIP] (do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)));
return (Inr (cteCap cte))
od) (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']));;
(\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (?A9308 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'9305 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv'a t t'. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ceqv \<Gamma> cap_' rv'a t t' (\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))) (?g'9311 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv'a)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv rv'a. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) rv'a; True\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (\<lambda>a. ?Q9313 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () a rv) (?Q'9314 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv rv'a) [SKIP] (return (Inr (cteCap rv))) (?g'9311 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv'a)
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9313 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa cte) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> ?Q'9314 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv rv'a. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) rv'a; True\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (\<lambda>a. ?Q9313 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () a rv) (?Q'9314 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv rv'a) [SKIP] (return (Inr (cteCap rv))) (\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,rv'a);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9313 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa cte) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> ?Q'9314 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap; True\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (\<lambda>a. ?Q9313 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () a rv) (?Q'9314 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (\<acute>bits :== 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,getCTE_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9313 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa cte) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> ?Q'9314 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap; True\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q9774 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv) (?G'10250 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (IF (if 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,getCTE_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9774 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a cte aa) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> {sb. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) sb \<in> {sb. sb\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> ?G'10250 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap}}) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap; True\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q9774 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv) (?R'10352 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (SKIP;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9774 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a cte aa) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> {sb. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) sb \<in> {sb. sb\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> ?R'10352 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q9774 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv) (?R'10352 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
ELSE
  IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9774 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a cte aa) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> {sb. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) sb \<in> {sb. sb\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> ?R'10352 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q9774 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv) (?R'10375 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9774 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a cte aa) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> {sb. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) sb \<in> {sb. sb\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> ?R'10375 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q9774 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv) (?R'10380 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (SKIP;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9774 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a cte aa) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> {sb. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) sb \<in> {sb. sb\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> ?R'10380 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q9774 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv) (?R'10380 (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap) rv getCTE_cap) [SKIP] (return (Inr (cteCap rv))) (return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>aa. \<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> ?Q9774 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a cte aa) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> {sb. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) sb \<in> {sb. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) sb \<in> {sb. sb\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> ?R'10380 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va cte cap \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (va + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> \<lbrace>\<acute>cap = getCTE_cap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__struct_cap_C_'_update cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr (cteCap rv)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv getCTE_cap \<sigma>. \<lbrakk>cbits = 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)); ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap) \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> acptr && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch (capCNodeBits acap + capCNodeGuardSize acap) (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits = capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation (cteCap rv) getCTE_cap\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> \<lbrace>\<acute>cap = getCTE_cap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr (cteCap rv)) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := cap_' s, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (cap_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (doE t <- if abits = capCNodeBits acap + capCNodeGuardSize acap then returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)), 0) else do nextCap <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
case nextCap of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits nextCap acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap))
od;
liftE (getSlotCap (fst t))
odE)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (cutMon ((=) sb) (do rv <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
doE t <- case rv of capability.CNodeCap x xa xb xc \<Rightarrow> CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) | _ \<Rightarrow> returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE
od)) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?U7830 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (do rv <- cutMon ((=) sb) (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))));
cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (Guard ShiftError (if 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (Guard ShiftError (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?U7830 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a)})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa rv' sb. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?C'10426 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv') [SKIP] (do rv <- cutMon ((=) sb) (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))));
cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (\<acute>radix :== acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(ccap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> ?C'10426 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr_CL (cap_cnode_cap_lift ccap)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?G'10973 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' ret__unsigned) [SKIP] (do rv <- cutMon ((=) sb) (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))));
cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (Guard MemorySafety \<lbrace>acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr ret__unsigned) (unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (ret__unsigned + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> ?G'10973 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?G'10973 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) [SKIP] (do rv <- cutMon ((=) sb) (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))));
cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (Guard MemorySafety \<lbrace>acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr (capCNodePtr acap)) (unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> ?G'10973 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?T7828 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?G'10973 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) [SKIP] (do a <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
cutMon (\<lambda>s'. (a, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap a then CSpace_H.resolveAddressBits a acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (Guard MemorySafety \<lbrace>acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr (capCNodePtr acap)) (unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ?T7828 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> ?G'10973 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?G11380 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?G'10973 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) [SKIP] (do a <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
cutMon (\<lambda>s'. (a, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap a then CSpace_H.resolveAddressBits a acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (Guard MemorySafety \<lbrace>acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap = 0 \<or> array_assertion (cte_Ptr (capCNodePtr acap)) (unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ?G11380 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> ?G'10973 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?A11890 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()) (?C'11887 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) [SKIP] (do a <- getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
cutMon (\<lambda>s'. (a, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap a then CSpace_H.resolveAddressBits a acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)
od) (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']));;
(\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,\<acute>cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> (?A11890 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> ?C'11887 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv) (?Q'11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap) [SKIP] (cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (\<acute>bits :== 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap));;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> ?Q'11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc)}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv) (?G'12847 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap) [SKIP] (cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (IF (if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?G'12847 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc)}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv) (?R'12947 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap) [SKIP] (cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap,cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0);;
(WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> ?R'12947 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv) (?G'13023 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int) [SKIP] (cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (doE t <- if isCNodeCap rv then CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap)) else returnOk (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)), abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (WHILE \<acute>ret__int \<noteq> 0
INV if undefined then UNIV else {}
DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'13023 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?G'13023 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon (\<lambda>s'. (rv, s') \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)) (if isCNodeCap rv then doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE else liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
ELSE
  IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'13023 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?G'13023 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (if isCNodeCap rv then doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE else liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
ELSE
  IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'13023 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?Q11897 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?G'13023 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (if isCNodeCap rv then cutMon ((=) sc) (doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE) else cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
ELSE
  IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'
FI)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>?Q11897 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> ?G'13023 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb)\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<and> ret__int_' s' = from_bool (isCNodeCap rv) \<longrightarrow> isCNodeCap rv = (s' \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R13341 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?R'13337 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>sc. isCNodeCap a \<longrightarrow> ?R13341 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?R'13337 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 7. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 8. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R13341 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?R'13337 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>sc. isCNodeCap a \<longrightarrow> ?R13341 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?R'13337 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R13341 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?R'13337 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>sc. isCNodeCap a \<longrightarrow> ?R13341 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?R'13337 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (8 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?R13341 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?R'13337 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (doE t <- CSpace_H.resolveAddressBits rv acptr (abits - (capCNodeBits acap + capCNodeGuardSize acap));
liftE (getSlotCap (fst t))
odE)) (?s13411 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc)
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); isCNodeCap rv\<rbrakk> \<Longrightarrow> ?s13411 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc = (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>sc. isCNodeCap a \<longrightarrow> ?R13341 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?R'13337 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 7. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 8. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (7 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); isCNodeCap rv\<rbrakk> \<Longrightarrow> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_'))))))))))))))))))) = (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(While \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc();;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc();;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc();;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc();;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI);;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 6. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 7. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (cutMon ((=) sc) (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (liftE (getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst ((do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
return (cteCap cte)
od) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?U13339 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv) (?U'13335 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap])) [SKIP] (do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
return (Inr (cteCap cte))
od) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> ?U13339 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc)\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> ?U'13335 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v)}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc rva. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst ((do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
return (cteCap cte)
od) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (\<lambda>a. ?P13535 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv a rva) (?P'13537 ccap s sa rv' sb rv cap rva) [SKIP] (return (Inr (cteCap rva))) (IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> (\<forall>cte. ctes_of sc (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> ?P13535 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a sc cte))\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> {sd. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sd) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sd \<in> ?P'13536 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v cte'})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}
flex-flex pairs:
\<lambda>ccap s sa rv' sb rv cap cte'. ?P'13537 ccap s sa rv' sb rv cap (cte_to_H cte') \<equiv>\<^sup>? \<lambda>ccap s sa rv' sb rv cap. ?P'13536 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]) proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc rva. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst ((do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
return (cteCap cte)
od) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (?P13544 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv rva) (?R'13545 ccap s sa rv' sb rv cap rva) [SKIP] (return (Inr (cteCap rva))) (SKIP;;
return_C ret__struct_cap_C_'_update cap_')
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>sc. \<not> isCNodeCap a \<longrightarrow> (\<forall>cte. ctes_of sc (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> ?P13544 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned a cte sc))\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {sc. \<forall>rv. ccap_relation rv (cap_' sc) \<longrightarrow> sc \<in> {sd. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sd \<in> {sd. sd\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sd. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' sc) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sd))] \<longrightarrow> sd\<lparr>ret__int_' := v\<rparr> \<in> {sd. sd\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sd. (sd \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sd \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sd \<in> {sd. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sd) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sd \<in> ?R'13542 cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv (cap_' sc) v cte' \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace>})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}
flex-flex pairs:
\<lambda>ccap s sa rv' sb rv cap cte'. ?R'13545 ccap s sa rv' sb rv cap (cte_to_H cte') \<equiv>\<^sup>? \<lambda>ccap s sa rv' sb rv cap. ?R'13542 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa rv' sb (capCNodePtr acap) rv cap (of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]) proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc rva. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst ((do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
return (cteCap cte)
od) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. cteCap rva = rv \<and> s \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} SKIP;;
return_C ret__struct_cap_C_'_update cap_' {},{s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr (cteCap rva)) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (ret__struct_cap_C_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> (\<forall>cte. ctes_of s (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = a))\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sa. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))] \<longrightarrow> sa\<lparr>ret__int_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> \<lbrace>\<acute>cap = \<^bsup>s\<^esup>cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace>})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (6 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned rv cap ret__int sc rva \<sigma>. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap; ccap_relation rv cap; ret__int = of_bl [cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap]; (rv, sc) \<in> fst ((do cte <- getCTE (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)));
return (cteCap cte)
od) sb); \<not> isCNodeCap rv\<rbrakk> \<Longrightarrow> {s. cteCap rva = rv \<and> s \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return (Inr (cteCap rva)) \<sigma>). (\<sigma>', s\<lparr>ret__struct_cap_C_' := cap_' s, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> ccap_relation (case rv of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v) (cap_' s)}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> (\<forall>cte. ctes_of s (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = a))\<rbrace>
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sa. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))] \<longrightarrow> sa\<lparr>ret__int_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> \<lbrace>\<acute>cap = \<^bsup>s\<^esup>cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace>})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 5. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 6. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a. (\<lambda>_. True) and (\<lambda>s. isCNodeCap a \<longrightarrow> (valid_cap' a and valid_objs') s) and (\<lambda>s. \<not> isCNodeCap a \<longrightarrow> (\<forall>cte. ctes_of s (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = a))\<rbrace>
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sa. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))] \<longrightarrow> sa\<lparr>ret__int_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> \<lbrace>\<acute>cap = \<^bsup>s\<^esup>cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace>})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (5 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<lbrace>?R11906 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa ()\<rbrace> getSlotCap (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) \<lbrace>\<lambda>a aa. (isCNodeCap a \<longrightarrow> valid_cap' a aa \<and> valid_objs' aa) \<and> (\<not> isCNodeCap a \<longrightarrow> (\<forall>cte. ctes_of aa (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = a))\<rbrace>
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sa. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))] \<longrightarrow> sa\<lparr>ret__int_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> \<lbrace>\<acute>cap = \<^bsup>s\<^esup>cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace>})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a aa. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) aa \<longrightarrow> ((\<lambda>a. True) and ?R11906 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa a and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) aa)\<rbrace>, -
 4. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 5. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> s \<in> {sa. bits_'_update (\<lambda>_. 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) sa \<in> {sa. sa\<lparr>ret__int_' := if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0\<rparr> \<in> {sa. \<forall>v. v = of_bl [cap_get_tag (cap_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))) = cap_type_tag_' (cap_'_update (\<lambda>x. cap_' s) (cap_type_tag_'_update (\<lambda>_. SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) sa))] \<longrightarrow> sa\<lparr>ret__int_' := v\<rparr> \<in> {sa. sa\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>ret__int = from_bool (isCNodeCap rv)\<rbrace> \<inter> {sa. (sa \<in> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> UNIV \<inter> \<lbrace>ccap_relation rv \<acute>cap \<and> isCNodeCap rv\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat (abits - (capCNodeBits acap + capCNodeGuardSize acap)) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32 \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<noteq> 0\<rbrace>) \<and> (sa \<notin> \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<longrightarrow> sa \<in> {sa. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift sa) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> sa \<in> \<lbrace>\<acute>cap = \<^bsup>s\<^esup>cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace>})}}} \<inter> \<lbrace>(if 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a b. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) b) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap a \<and> valid_objs' a) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) b)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (4 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsignedc sa rv' sb ret__unsigned. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsignedc = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s); (Inr (), sb) \<in> fst (whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) sa); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ret__unsigned = capCNodePtr acap\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'11900 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa () rv' (capCNodePtr acap)) \<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C''])) {s. \<forall>rv. ccap_relation rv (cap_' s) \<longrightarrow> (if of_bl [cap_get_tag (cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 then 1 else 0) = from_bool (isCNodeCap rv) \<and> (of_bl [cap_get_tag (cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 \<longrightarrow> isCNodeCap rv \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (of_bl [cap_get_tag (cap_' s) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20}
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a b. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) b) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap a \<and> valid_objs' a) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) b)\<rbrace>, -
 3. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {sb. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> sb \<in> {sb. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) sb \<in> {sb. \<forall>va v'. va = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) sb))) \<longrightarrow> sb\<lparr>ret__unsigned_' := va\<rparr> \<in> {sb. sb \<in> {sb. slot_'_update (\<lambda>_. cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) sb \<in> \<lbrace>cte_Ptr (va + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> ?R'11900 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa (theRight v) a va \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 4. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (3 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<lbrace>?R7560 (0x20 - word_of_nat abits) ccap\<rbrace> whenE ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap) (throwError (Fault_H.lookup_failure.GuardMismatch abits (capCNodeGuard acap) (capCNodeGuardSize acap))) \<lbrace>\<lambda>a b. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) b) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) b \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap a \<and> valid_objs' a) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) b)\<rbrace>, -
 2. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> \<lbrace>cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> {s. \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 then 1 else 0) = from_bool (isCNodeCap rv) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 \<longrightarrow> isCNodeCap rv \<and> ret__unsigneda + ret__unsignedb = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < cbits + (ret__unsigneda + ret__unsignedb)) \<and> cbits + (ret__unsigneda + ret__unsignedb) < 0x20} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 3. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and ?R7560 cbits ccap) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI (ccHoarePost (inr_rrel dc) xfdc (\<lambda>v a. {s. (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> {s. (\<forall>cte cap. ccap_relation (cteCap cte) cap \<and> True \<longrightarrow> cap_'_update (\<lambda>_. cap) s \<in> {s. bits_'_update (\<lambda>_. cbits + (ret__unsigneda + ret__unsignedb)) s \<in> {s. s\<lparr>ret__int_' := if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0\<rparr> \<in> \<lbrace>\<acute>cap = cap\<rbrace> \<inter> - \<lbrace>0x20 < \<acute>bits\<rbrace> \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace> \<inter> - \<lbrace>(if cbits + (ret__unsigneda + ret__unsignedb) < 0x20 then 1 else 0) \<noteq> 0\<rbrace>}}) \<and> cte_Ptr (v + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)))} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {})) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. radix_'_update (\<lambda>_. acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) s \<in> {s. \<forall>v v'. v = capCNodePtr_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. slot_'_update (\<lambda>_. cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))) s \<in> \<lbrace>cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) = cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rbrace> \<inter> {s. \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 then 1 else 0) = from_bool (isCNodeCap rv) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 \<longrightarrow> isCNodeCap rv \<and> ret__unsigneda + ret__unsignedb = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (v + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < cbits + (ret__unsigneda + ret__unsignedb)) \<and> cbits + (ret__unsigneda + ret__unsignedb) < 0x20} \<inter> \<lbrace>True\<rbrace>} \<inter> \<lbrace>True\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> (if ret__unsigneda < 0x20 then UNIV else {}) \<inter> (if 0x20 - ret__unsignedb < 0x20 then UNIV else {}))})),UNIV
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and (\<lambda>a. \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap a \<and> valid_objs' a) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) a))) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (2 subgoals):
 1. \<And>cbits ccap ret__unsigneda ret__unsignedb s ret__unsigned sa. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; ret__unsigneda = capCNodeGuardSize_CL (cap_cnode_cap_lift ccap); ret__unsignedb = capCNodeRadix_CL (cap_cnode_cap_lift ccap); 0 < capCNodeBits acap \<or> 0 < capCNodeGuardSize acap; (Inr (), s) \<in> fst (assertE True as); ret__unsigned = capCNodeGuard acap; \<not> abits < capCNodeBits acap + capCNodeGuardSize acap; ((), sa) \<in> fst (stateAssert (\<lambda>s. (case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB) [] s)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/?F7551 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) s (capCNodeGuard acap) sa\<^esub> (?R'7554 (0x20 - word_of_nat abits) ccap (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) (capCNodeGuard acap)) IF capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 THEN
  Guard ShiftError (if 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 then UNIV else {}) (\<acute>ret__int :== (if acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) \<noteq> capCNodeGuard acap then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI {s. (\<exists>rv. inr_rrel dc rv (xfdc s)) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20) \<and> capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 then 1 else 0) = from_bool (isCNodeCap rv) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 \<longrightarrow> isCNodeCap rv \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)},UNIV
 2. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and (\<lambda>a. \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap a \<and> valid_objs' a) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) a))) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> ?R'7554 cbits ccap v va vb}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (1 subgoal):
 1. \<And>cbits ccap s s'. \<lbrakk>cbits = 0x20 - word_of_nat abits; ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; abits \<noteq> 0; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap \<and> capCNodeGuardSize acap < 32 \<and> capCNodeBits acap < 32 \<and> capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap \<and> unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap \<and> unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap \<and> unat (0x20 - word_of_nat abits) = 32 - abits \<and> unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; (s, s') \<in> rf_sr; (valid_cap' acap and valid_objs') s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<or> isThreadCap acap \<or> isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (\<forall>rv'. (rv' \<noteq> 0 \<longrightarrow> True) \<and> (\<not> rv' \<noteq> 0 \<longrightarrow> ((\<lambda>a. True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) s))) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. ((if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> True)) \<and> (\<not> (if capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> valid_cap' acap a)) and (\<lambda>a. \<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<lambda>a. \<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) = Some cte \<longrightarrow> True \<and> True) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) a) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<longrightarrow> ((\<lambda>a. True) and (\<lambda>a. \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) a \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap a \<and> valid_objs' a) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of a (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) and cte_wp_at' (\<lambda>_. True) (ptr_val (cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))))) and (\<lambda>s. \<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) a))) s)) \<and> s' \<in> {s. \<forall>v v'. v = capCNodeGuardSize_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. guardBits_'_update (\<lambda>_. v) s \<in> {s. \<forall>va v'. va = capCNodeRadix_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. radixBits_'_update (\<lambda>_. va) s \<in> {s. cptr2_'_update (\<lambda>_. acptr << unat cbits) s \<in> {s. \<forall>vb v'. vb = capCNodeGuard_CL (cap_cnode_cap_lift (cap_' (cap_'_update (\<lambda>_. ccap) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<and> ((if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> ret__int_' s = 0 \<longrightarrow> 0x20 < cbits + (v + va) \<and> \<not> cbits + (v + va) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)}}}) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> s \<in> {s. capGuard_'_update (\<lambda>_. vb) s \<in> {s. s\<lparr>ret__int_' := if v \<noteq> 0 then 1 else 0\<rparr> \<in> {s. ((if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> {s. s\<lparr>ret__int_' := if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0\<rparr> \<in> {s. ((acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> UNIV) \<and> (\<not> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) \<noteq> vb \<longrightarrow> s \<in> {s. inr_rrel dc (Inr ()) (xfdc s)})}} \<inter> (if 0x20 - v < 0x20 then UNIV else {})) \<and> (\<not> (if v \<noteq> 0 then 1 else 0) \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> - \<lbrace>\<acute>ret__int \<noteq> 0\<rbrace>)} \<inter> {s. (v \<noteq> 0 \<longrightarrow> s \<in> (if 0x20 - v < 0x20 then UNIV else {}) \<longrightarrow> (if acptr << 32 - abits >> unat (0x20 - v) \<noteq> vb then 1 else 0) = 0 \<longrightarrow> (\<exists>rv. inr_rrel dc rv (xfdc (s\<lparr>ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte a. ccap_relation (cteCap cte) a) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (v + va) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (v + va) < 0x20) \<and> capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 then 1 else 0) = from_bool (isCNodeCap rv) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 \<longrightarrow> isCNodeCap rv \<and> v + va = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < cbits + (v + va)) \<and> cbits + (v + va) < 0x20) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)) \<and> (\<not> v \<noteq> 0 \<longrightarrow> (ret__int_' s \<noteq> 0 \<longrightarrow> True) \<and> (\<not> ret__int_' s \<noteq> 0 \<longrightarrow> (\<exists>rv. inr_rrel dc rv (xfdc s)) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte a. ccap_relation (cteCap cte) a) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (v + va) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (v + va) < 0x20) \<and> capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 then 1 else 0) = from_bool (isCNodeCap rv) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] \<noteq> 0 \<longrightarrow> isCNodeCap rv \<and> v + va = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (of_bl [cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap] = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s) (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < cbits + (v + va)) \<and> cbits + (v + va) < 0x20) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> v < 0x20 \<and> 0x20 - va < 0x20)))}}})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}} \<inter> \<lbrace>cbits < 0x20\<rbrace>}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. ccap) s)) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap} proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ((case gsCNodes s (global.capUntypedPtr acap) of None \<Rightarrow> False | Some n \<Rightarrow> (n = capCNodeBits acap \<or> isZombie acap \<and> n = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ n) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap) \<and> \<not> 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20) \<and> capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then 1 else 0) = from_bool (isCNodeCap rv) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> isCNodeCap rv \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (from_bool (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap then 1 else 0) = from_bool (isCNodeCap rv) \<and> (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<longrightarrow> isCNodeCap rv \<and> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (from_bool (cap_get_tag (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap) = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (global.capUntypedPtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20))) \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap \<and> 0x20 - word_of_nat abits < 0x20 \<and> cap_get_tag ccap = SCAST(32 signed \<rightarrow> 32) cap_cnode_cap proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<and> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> (x2 = capCNodeBits acap \<or> isZombie acap \<and> x2 = zombieCTEBits (capZombieType acap)) \<and> (acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap) < 2 ^ x2) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20 \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 0x20 < 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap) \<and> \<not> 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (\<not> abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> 0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (from_bool (isCNodeCap rv) = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 0x20) \<and> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) < 0x20 \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> \<not> 0x20 < 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) \<and> \<not> 0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (from_bool (isCNodeCap rv) = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> \<not> 0x20 < 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20) \<and> 0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap) < 0x20))) \<and> 0x20 - word_of_nat abits < 0x20 proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<and> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> (x2 = capCNodeBits acap \<or> isZombie acap \<and> x2 = zombieCTEBits (capZombieType acap)) \<and> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < unat (2 ^ x2)) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<le> 32 \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (from_bool (isCNodeCap rv) = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<le> 32 \<and> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> (from_bool (isCNodeCap rv) = 0 \<longrightarrow> (\<exists>cte'. (cte_lift \<circ>\<^sub>m cslift s') (cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))) = Some cte' \<and> cl_valid_cte cte') \<longrightarrow> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<and> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> (x2 = capCNodeBits acap \<or> isZombie acap \<and> x2 = zombieCTEBits (capZombieType acap)) \<and> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < unat (2 ^ x2)) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; \<not> isZombie acap \<and> \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<and> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> (x2 = capCNodeBits acap \<or> isZombie acap \<and> x2 = zombieCTEBits (capZombieType acap)) \<and> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < unat (2 ^ x2)) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32)))
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> \<not> isZombie acap \<and> \<not> isThreadCap acap proof (prove)
goal (2 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap\<rbrakk> \<Longrightarrow> \<not> isZombie acap \<and> \<not> isThreadCap acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; \<not> isZombie acap \<and> \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<and> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> (x2 = capCNodeBits acap \<or> isZombie acap \<and> x2 = zombieCTEBits (capZombieType acap)) \<and> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < unat (2 ^ x2)) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; \<not> isZombie acap \<and> \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<and> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> (x2 = capCNodeBits acap \<or> isZombie acap \<and> x2 = zombieCTEBits (capZombieType acap)) \<and> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < unat (2 ^ x2)) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isThreadCap acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (isZombie acap \<and> capZombieType acap = ZombieTCB \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; \<not> isZombie acap \<and> \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> ((\<exists>y. gsCNodes s (capCNodePtr acap) = Some y) \<longrightarrow> (\<forall>x2. gsCNodes s (capCNodePtr acap) = Some x2 \<longrightarrow> x2 = capCNodeBits acap \<and> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < unat (2 ^ x2)) \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> (\<exists>n. gsCNodes s (capCNodePtr acap) = Some n \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ n)))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; \<not> isZombie acap \<and> \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> (gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap) \<longrightarrow> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ capCNodeBits acap) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> unat (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ capCNodeBits acap) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s \<and> unat (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) \<le> 2 ^ capCNodeBits acap))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; \<not> isZombie acap \<and> \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> (gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap) \<longrightarrow> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32) \<and> 32 - capCNodeBits acap < 32)) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap)) \<and> 32 - capCNodeBits acap < 32) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32) \<and> 32 - capCNodeBits acap < 32))) proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap\<rbrakk> \<Longrightarrow> (gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap) \<longrightarrow> unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap \<longrightarrow> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<longrightarrow> (\<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))) \<and> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s))) \<and> (abits < capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32 \<and> (acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))))) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))) \<and> (capCNodeBits acap + capCNodeGuardSize acap \<le> abits \<longrightarrow> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0 \<longrightarrow> acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32))) \<and> (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0 \<longrightarrow> (\<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>))) \<longrightarrow> (abits = capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> ((\<exists>cte. Ex (ccap_relation (cteCap cte))) \<longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32) \<and> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))) \<and> (abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap \<longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) \<and> (\<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32)))) proof (prove)
goal (16 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * 0x10) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> capCNodePtr acap = capCNodePtr acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap < 2 ^ capCNodeBits acap
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap < 2 ^ capCNodeBits acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap) && mask (32 - capCNodeBits acap + capCNodeBits acap) = acptr << 32 - abits << capCNodeGuardSize acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> capCNodeBits acap < LENGTH(32)
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; abits < capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> capCNodeBits acap < LENGTH(32)
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * 0x10) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> capCNodePtr acap = capCNodePtr acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap < 2 ^ capCNodeBits acap
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap < 2 ^ capCNodeBits acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap) && mask (32 - capCNodeBits acap + capCNodeBits acap) = acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> capCNodeBits acap < LENGTH(32)
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat (acptr && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; (acptr >> capCNodeBits acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> capCNodeBits acap < LENGTH(32)
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> \<exists>cap. cte_wp_at' (\<lambda>c. cteCap c = cap) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s \<and> (isCNodeCap cap \<longrightarrow> valid_cap' cap s) \<and> (\<not> isCNodeCap cap \<longrightarrow> (\<forall>cte. ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte \<longrightarrow> cteCap cte = cap))
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>ccap s s' cte. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; ctes_of s (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) = Some cte; isCNodeCap (cteCap cte)\<rbrakk> \<Longrightarrow> valid_cap' (cteCap cte) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C))) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap + capCNodeGuardSize acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 0x10 * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 0x10 * (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap)) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap + capCNodeGuardSize acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; gsCNodes s (capCNodePtr acap) = Some (capCNodeBits acap); unat ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)) < 2 ^ capCNodeBits acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 0x10 * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s\<rbrakk> \<Longrightarrow> cte_wp_at' (\<lambda>_. True) (capCNodePtr acap + 0x10 * (((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))) s
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0\<rbrakk> \<Longrightarrow> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) < 32
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) \<noteq> 0; acptr << 32 - abits >> unat (0x20 - capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32 - capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
A total of 12 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuardSize acap < 32; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap + capCNodeGuardSize acap; 0 < capCNodeGuardSize acap; acptr << 32 - abits >> 32 - capCNodeGuardSize acap = capCNodeGuard acap\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)))
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; 0 < abits; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; \<not> isZombie acap; \<not> isThreadCap acap; abits < capCNodeBits acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0\<rbrakk> \<Longrightarrow> 32 < unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; 0 < capCNodeGuardSize acap; acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap), ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)) + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) = 32
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; 0 < capCNodeGuardSize acap; acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap), ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; acptr << 32 - abits >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap + capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; acptr << 32 - abits >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> unat (0x20 - word_of_nat abits + (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap))) < 32
 7. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap; \<exists>cte. Ex (ccap_relation (cteCap cte))\<rbrakk> \<Longrightarrow> unat (0x20 - word_of_nat (capCNodeBits acap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = 32
 8. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 9. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 10. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> unat (0x20 - word_of_nat abits + capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 32 proof (prove)
goal (6 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))) = 32 - (capCNodeBits acap + capCNodeGuardSize acap); 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; 0 < capCNodeGuardSize acap; acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap), ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - (capCNodeBits acap + capCNodeGuardSize acap) << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; acptr << 32 - abits >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits << capCNodeGuardSize acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; acptr << 32 - abits >> 32 - capCNodeGuardSize acap = capCNodeGuard acap; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> 32 + (capCNodeGuardSize acap + capCNodeBits acap) - abits < 32
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 5. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 6. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> 32 + capCNodeBits acap - abits < 32 proof (prove)
goal (4 subgoals):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (if isCNodeCap rva then 1 else 0) = from_bool (isCNodeCap rva) \<and> (isCNodeCap rva \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> capCNodeBits acap + (capCNodeGuardSize acap + 32) - abits < 32
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> 32 + capCNodeBits acap - abits < 32 proof (prove)
goal (4 subgoals):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (isCNodeCap rva \<longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap) \<and> abits - (capCNodeBits acap + capCNodeGuardSize acap) \<le> 32) \<and> capCNodeBits acap + (capCNodeGuardSize acap + 32) - abits < 32
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> 32 + capCNodeBits acap - abits < 32 proof (prove)
goal (4 subgoals):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))); isCNodeCap rva\<rbrakk> \<Longrightarrow> capCNodeGuardSize_CL (cap_cnode_cap_lift ccap) + capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap)
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> 32 + capCNodeBits acap - abits < 32 proof (prove)
goal (4 subgoals):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = capCNodeGuardSize acap; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap + capCNodeGuardSize acap \<le> abits; 0 < capCNodeGuardSize acap; (acptr >> abits - capCNodeGuardSize acap) && mask (capCNodeGuardSize acap) = capCNodeGuard acap; abits \<noteq> capCNodeBits acap + capCNodeGuardSize acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := capCNodeGuardSize_CL (cap_cnode_cap_lift ccap), radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - (capCNodeBits acap + capCNodeGuardSize acap)) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))); isCNodeCap rva\<rbrakk> \<Longrightarrow> (if unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) + unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) < 2 ^ LENGTH(32) then unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) + unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) else unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) + unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) - 2 ^ LENGTH(32)) = unat (word_of_nat (capCNodeBits acap) + word_of_nat (capCNodeGuardSize acap))
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 4. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> 32 + capCNodeBits acap - abits < 32 proof (prove)
goal (3 subgoals):
 1. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeBits acap < 32; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat (capCNodeBits acap)) = 32 - capCNodeBits acap; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - capCNodeBits acap, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits = capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - capCNodeBits acap >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * (acptr && mask (capCNodeBits acap))
 2. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> (acptr << 32 - abits >> 32 - capCNodeBits acap) * word_of_nat (size_of TYPE(cte_C)) = 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap))
 3. \<And>ccap s s'. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; \<exists>rv. inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); abits \<noteq> capCNodeBits acap\<rbrakk> \<Longrightarrow> \<forall>rv. ccap_relation rv (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 2 ^ cte_level_bits * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))) \<longrightarrow> (if isCNodeCap rv then 1 else 0) = from_bool (isCNodeCap rv) \<and> (isCNodeCap rv \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> 32 + capCNodeBits acap - abits < 32 proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; abits \<noteq> capCNodeBits acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (if isCNodeCap rva then 1 else 0) = from_bool (isCNodeCap rva) \<and> (isCNodeCap rva \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> capCNodeBits acap + 32 - abits < 32 proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; abits \<noteq> capCNodeBits acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C''])))\<rbrakk> \<Longrightarrow> (isCNodeCap rva \<longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) \<and> abits - capCNodeBits acap \<le> 32) \<and> capCNodeBits acap + 32 - abits < 32 proof (prove)
goal (1 subgoal):
 1. \<And>ccap s s' rv rva. \<lbrakk>ccap_relation acap ccap; isCNodeCap acap; abits \<le> 32; (s, s') \<in> rf_sr; capCNodePtr_CL (cap_cnode_cap_lift ccap) = capCNodePtr acap; valid_cap' acap s; valid_objs' s; capCNodeGuard_CL (cap_cnode_cap_lift ccap) = capCNodeGuard acap; capCNodeGuardSize acap = 0; unat (capCNodeRadix_CL (cap_cnode_cap_lift ccap)) = capCNodeBits acap; unat (0x20 - word_of_nat abits) = 32 - abits; 0 < capCNodeBits acap; \<not> isZombie acap; \<not> isThreadCap acap; capCNodeBits acap \<le> abits; unat (capCNodeGuardSize_CL (cap_cnode_cap_lift ccap)) = 0; abits \<noteq> capCNodeBits acap; inr_rrel (\<lambda>a b. True) rv (xfdc (s'\<lparr>guardBits_' := 0, radixBits_' := capCNodeRadix_CL (cap_cnode_cap_lift ccap), cptr2_' := acptr << 32 - abits, ret__unsigned_' := capCNodeGuard acap, capGuard_' := capCNodeGuard acap, ret__int_' := 0\<rparr>)); ccap_relation rva (h_val (hrs_mem (t_hrs_' (globals s'))) (cap_Ptr &(cte_Ptr (capCNodePtr acap + 0x10 * ((acptr >> abits - capCNodeBits acap) && mask (capCNodeBits acap)))\<rightarrow>[''cap_C'']))); isCNodeCap rva\<rbrakk> \<Longrightarrow> capCNodeRadix_CL (cap_cnode_cap_lift ccap) = word_of_nat (capCNodeBits acap) proof (prove)
goal:
No subgoals! proof (state)
this:
ccorres (\<lambda>mcp. ccap_relation (case mcp of Inl v \<Rightarrow> capability.NullCap | Inr v \<Rightarrow> v)) ret__struct_cap_C_' (valid_cap' acap and valid_objs') (UNIV \<inter> \<lbrace>ccap_relation acap \<acute>cap \<and> isCNodeCap acap\<rbrace> \<inter> \<lbrace>\<acute>bits = 0x20 - word_of_nat abits \<and> abits \<le> 32 \<and> abits \<noteq> 0\<rbrace>) [SKIP] (cutMon ((=) as) (doE t <- CSpace_H.resolveAddressBits acap acptr abits;
liftE (getSlotCap (fst t))
odE)) (\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
(\<acute>guardBits :== \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
(\<acute>radixBits :== \<acute>ret__unsigned;;
(Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
(\<acute>capGuard :== \<acute>ret__unsigned;;
(\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
(Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
(\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
(Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
(\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
(\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
(IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI;;
(WHILE \<acute>ret__int \<noteq> 0 DO
  \<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuardSize_'proc(\<acute>cap);;
\<acute>guardBits :== \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeRadix_'proc(\<acute>cap);;
\<acute>radixBits :== \<acute>ret__unsigned;;
Guard ShiftError \<lbrace>\<acute>bits < 0x20\<rbrace> (\<acute>cptr2 :== acptr << unat \<acute>bits);;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodeGuard_'proc(\<acute>cap);;
\<acute>capGuard :== \<acute>ret__unsigned;;
\<acute>ret__int :== (if \<acute>guardBits \<noteq> 0 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  Guard ShiftError \<lbrace>0x20 - \<acute>guardBits < 0x20\<rbrace> (\<acute>ret__int :== (if \<acute>cptr2 >> unat (0x20 - \<acute>guardBits) \<noteq> \<acute>capGuard then 1 else 0))
FI;;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
Guard ShiftError \<lbrace>0x20 - \<acute>radixBits < 0x20\<rbrace> (Guard ShiftError \<lbrace>\<acute>guardBits < 0x20\<rbrace> (\<acute>radix :== \<acute>cptr2 << unat \<acute>guardBits >> unat (0x20 - \<acute>radixBits)));;
\<acute>ret__unsigned :== CALL cap_cnode_cap_get_capCNodePtr_'proc(\<acute>cap);;
Guard MemorySafety \<lbrace>\<acute>radix = 0 \<or> array_assertion (cte_Ptr \<acute>ret__unsigned) (unat \<acute>radix) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>slot :== cte_Ptr (\<acute>ret__unsigned + \<acute>radix * word_of_nat (size_of TYPE(cte_C))));;
Guard C_Guard {s. s \<Turnstile>\<^sub>c slot_' s} (\<acute>cap :== h_val (hrs_mem \<acute>t_hrs) (cap_Ptr &(\<acute>slot\<rightarrow>[''cap_C''])));;
\<acute>bits :== \<acute>bits + (\<acute>guardBits + \<acute>radixBits);;
\<acute>ret__int :== (if \<acute>bits < 0x20 then 1 else 0);;
IF \<acute>ret__int \<noteq> 0 THEN
  \<acute>ret__int :== CALL cap_capType_equals_'proc(\<acute>cap,SCAST(32 signed \<rightarrow> 32) cap_cnode_cap);;
\<acute>ret__int :== (if \<acute>ret__int \<noteq> 0 then 1 else 0)
FI
OD;;
(IF 0x20 < \<acute>bits THEN
  \<acute>ret__struct_cap_C :== CALL cap_null_cap_new_'proc();;
return_C ret__struct_cap_C_'_update ret__struct_cap_C_'
FI;;
return_C ret__struct_cap_C_'_update cap_')))))))))))))))))))

goal:
No subgoals!