theory Retype_DP

lemma seL4_Untyped_Retype_inc_no_preempt:
  "\<lbrakk>cap_object root_cnode_cap = root_cnode;
   ucptr_slot = offset ucptr root_size;
   is_cnode_cap root_cnode_cap;
   ncptr_slot = offset ncptr root_size;
   unat ncptr_slot_nat = ncptr_slot;
   one_lvl_lookup root_cnode_cap 32 root_size;
   guard_equal root_cnode_cap ucptr 32;
   guard_equal root_cnode_cap croot 32\<rbrakk>
  \<Longrightarrow> \<lbrace> K (nt\<noteq> UntypedType \<and> default_object  nt (unat ts) minBound = Some obj
    \<and> free_range\<subseteq> tot_free_range) and
    \<guillemotleft>root_tcb_id \<mapsto>f (Tcb tcb)
  \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap
  \<and>* (cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size))
  \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range
  \<and>* (root_cnode, ncptr_slot ) \<mapsto>c NullCap
  \<and>* (\<And>* ptr\<in>tot_free_range. ptr \<mapsto>o Untyped)
  \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap
  \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap
  \<and>* P\<guillemotright>
    and (\<lambda>s. \<not> has_children (root_cnode,ucptr_slot) (kernel_state s) \<longrightarrow> obj_range = free_range)
    and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)
  \<rbrace>
  seL4_Untyped_Retype ucptr nt ts croot node_index 0 ncptr_slot_nat 1
  \<lbrace>\<lambda>rv s. cdl_cdt (kernel_state s) child = Some parent\<rbrace>" apply (simp add:seL4_Untyped_Retype_def sep_state_projection2_def) apply (rule hoare_name_pre_state) apply (rule hoare_pre) apply (rule do_kernel_op_pull_back) apply (rule call_kernel_with_intent_allow_error_helper
     [where check= False and tcb = tcb and Q = Q  and Perror = Q
        for Q , simplified]) apply fastforce apply ((wp hoare_vcg_ex_lift set_cap_wp)+)[5] apply (rule_tac P = "\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode,ucptr_slot) nt (unat ts)
               [(root_cnode, ncptr_slot)]
               has_kids 1)"
           in hoare_gen_asmEx) apply clarsimp apply (rule hoare_vcg_E_elim[where P = P and P' = P for P,simplified,rotated]) apply wp apply (rule hoare_post_imp_R[OF hoare_vcg_conj_lift_R]) apply (rule valid_validE_R) apply (rule invoke_untyped_cdt_inc) apply (rule_tac P = "P1 \<and>* P2" for P1 P2 in
            invoke_untyped_one_wp
              [where free_range = free_range
                and obj_range = obj_range
                and obj = obj
                and tot_free_range = tot_free_range]) apply fastforce apply clarsimp apply (rule conjI) apply (sep_erule refl_imp, simp) apply fastforce apply (rule hoare_pre) apply (rule invoke_untyped_exception
              [where tot_free_range = tot_free_range and free_range = free_range and obj_range = obj_range], simp) apply force apply (wp hoare_vcg_conj_lift) apply (wp hoare_strengthen_post[OF set_cap_wp]) apply (sep_select 4,assumption) apply wp[1] apply (rule_tac P =" nt \<noteq> UntypedType
        \<and> c = UntypedCap dev obj_range free_range \<and> cs = [(root_cnode_cap,(root_cnode,offset croot root_size))]"
        in hoare_gen_asmEx) apply simp apply (rule decode_untyped_invocation_rvu) apply simp apply (simp add:lookup_extra_caps_def mapME_singleton) apply (rule wp_no_exception_seq) apply wp[1] apply (rule lookup_cap_and_slot_rvu[where r = root_size
       and  cap' = "root_cnode_cap"]) apply clarsimp apply (wp lookup_cap_and_slot_rvu[where r = root_size
       and cap' = "UntypedCap dev obj_range free_range"])[1] apply clarsimp apply (wp hoare_vcg_ball_lift
              update_thread_intent_update
              hoare_vcg_imp_lift hoare_vcg_ex_lift hoare_vcg_all_lift
              is_cnode_cap_guard_equal update_thread_intent_update ) apply clarsimp apply (erule conjE)+ apply (drule_tac x = "UntypedCap dev obj_range free_range" in spec) apply clarsimp apply (erule conjE)+ apply (drule_tac x = root_cnode_cap in spec) apply clarsimp apply (erule conjE)+ apply clarsimp apply (erule use_sep_true_for_sep_map_c) apply (thin_tac "<P \<and>* Q \<and>* sep_true> sa" for P Q) apply sep_solve apply clarsimp apply (intro conjI impI allI, simp_all) apply (clarsimp simp: user_pointer_at_def Let_def ep_related_cap_def
                                word_bits_def sep_conj_assoc
                         dest!: reset_cap_asid_simps2 reset_cap_asid_cnode_cap | sep_solve)+ done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = ncptr_slot; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32\<rbrakk> \<Longrightarrow> \<lbrace>K (nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and Separation_SD.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, ucptr_slot) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, ncptr_slot) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) and (\<lambda>s. \<not> has_children (root_cnode, ucptr_slot) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)\<rbrace> seL4_Untyped_Retype ucptr nt ts croot node_index 0 ncptr_slot_nat 1 \<lbrace>\<lambda>rv s. cdl_cdt (kernel_state s) child = Some parent\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>rv s. cdl_cdt (kernel_state s) child = Some parent\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>rv s. cdl_cdt (kernel_state s) child = Some parent\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Q5 s\<rbrace> do_kernel_op (call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False) \<lbrace>\<lambda>rv s. cdl_cdt (kernel_state s) child = Some parent\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> ?Q5 s sa proof (prove)
goal (2 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P8 s\<rbrace> call_kernel_with_intent \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> False \<lbrace>\<lambda>rv a. cdl_cdt a child = Some parent\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> ?P8 s (kernel_state sa) proof (prove)
goal (14 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> cdl_intent_op \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = Some (?intent_op10 s) \<and> cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = ?intent_cptr10 s \<and> cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> = ?intent_extra10 s
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?R10 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ra10 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>rv. ?R10 s\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl_cdt s child = Some parent\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Rb10 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>rv. ?Ra10 s\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl_cdt s child = Some parent\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent\<rbrace>
 7. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV10 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb10 s sa\<rbrace>, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (?intent_op10 s) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 8. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. ?PIV10 s iv\<rbrace>
 9. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (?intent_op10 s) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 10. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id (?intent_extra10 s) \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?R10 s\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RunningCap \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ra10 s\<rbrace> mark_tcb_intent_error root_tcb_id False \<lbrace>\<lambda>rv. ?R10 s\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl_cdt s child = Some parent\<rbrace> mark_tcb_intent_error root_tcb_id True \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Rb10 s\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>rv. ?Ra10 s\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. cdl_cdt s child = Some parent\<rbrace> corrupt_ipc_buffer root_tcb_id True \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent\<rbrace>
 6. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV10 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> ?Rb10 s sa\<rbrace>, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 7. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. ?PIV10 s iv\<rbrace>
 8. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 9. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 10. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
A total of 13 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?PIV10 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl_cdt s child = Some parent\<rbrace>, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. ?PIV10 s iv\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; \<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1)\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 s iv\<rbrace> perform_invocation True True iv \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl_cdt s child = Some parent\<rbrace>, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = cdl_intent_cap \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> cdl_intent_extras (cdl_tcb_intent tcb) = cdl_intent_extras \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. ?P'75 s iv and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl_cdt s child = Some parent\<rbrace>, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. ?P'75 s iv and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>rv s. cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl_cdt s child = Some parent\<rbrace>, -
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P'75 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. ?P'75 s iv and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P'101 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>rv s. cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) s \<and> cdl_cdt s child = Some parent\<rbrace>, -
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P'101 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P'101 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (11 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P108 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?Q106 s has_kids\<rbrace>, -
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?R107 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?S106 s has_kids\<rbrace>, -
 3. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; ?Q106 s has_kids rv sa \<and> ?S106 s has_kids rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 4. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P108 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa \<and> ?R107 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 5. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P108 s iv a \<and> ?R107 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 6. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P108 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>\<lambda>_. ?Q113 s has_kids\<rbrace>
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?R107 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?S106 s has_kids\<rbrace>, -
 3. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; ?Q113 s has_kids sa \<and> ?S106 s has_kids rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 4. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> ?P108 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa \<and> ?R107 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 5. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> ?P108 s iv a \<and> ?R107 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 6. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 7. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 9. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?R107 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) \<lbrace>?S106 s has_kids\<rbrace>, -
 2. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> ?S106 s has_kids rv sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 3. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> ?R107 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 4. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a (?child123 s iv) = Some (?parent122 s iv) \<and> ?R107 s iv a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 5. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (10 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0) = Retype (?uref141 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?nt143 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?ts144 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) [?dest_slot142 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))] (?has_kids124 s has_kids) (Suc 0)
 2. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (\<exists>oid free_range'. oid \<in> free_range \<and> free_range' \<subseteq> free_range - {oid} \<and> cdl.lift (?dest_slot142 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c default_cap (?nt143 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) {oid} (?ts144 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* ?uref141 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 3. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (K (default_object (?nt145 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) (?ts144 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) minBound = Some obj \<and> ?nt143 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift (?dest_slot142 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* ?uref141 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 4. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a (?child123 s iv) = Some (?parent122 s iv) \<and> (K (default_object (?nt145 s iv) (?ts144 s iv) minBound = Some obj \<and> ?nt143 s iv \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift (?dest_slot142 s iv \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* ?uref141 s iv \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* ?P1.139 s iv \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 5. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s has_kids. ?nt143 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<equiv>\<^sup>? \<lambda>s has_kids. ?nt145 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids rv sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (\<exists>oid free_range'. oid \<in> free_range \<and> free_range' \<subseteq> free_range - {oid} \<and> cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa)\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a (?child123 s iv) = Some (?parent122 s iv) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* ?P1.139 s iv \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))); oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a (?child123 s iv) = Some (?parent122 s iv) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* ?P1.139 s iv \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (10 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))); oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* (\<lambda>s. True)) sa
 2. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))); oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl_cdt sa child = Some parent
 3. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* ?P1.139 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))) \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 4. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a (?child123 s iv) = Some (?parent122 s iv) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* ?P1.139 s iv \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 5. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 6. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 8. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 10. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids sa oid free_range'. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))); oid \<in> free_range; free_range' \<subseteq> free_range - {oid}; cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c default_cap nt {oid} (unat ts) (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and>* oid \<mapsto>o obj \<and>* (SETSEPCONJ ptr:tot_free_range - {oid}. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range' \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) sa\<rbrakk> \<Longrightarrow> cdl_cdt sa child = Some parent
 2. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa (?child123 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) = Some (?parent122 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a (?child123 s iv) = Some (?parent122 s iv) \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (9 subgoals):
 1. \<And>s has_kids. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P'216 s has_kids\<rbrace> invoke_untyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) -, \<lbrace>\<lambda>rv sa. tcb_at' (\<lambda>tcb. cdl_intent_op (cdl_tcb_intent tcb) = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<and> cdl_intent_cap (cdl_tcb_intent tcb) = ucptr \<and> cdl_intent_extras (cdl_tcb_intent tcb) = [croot] \<and> \<not> cdl_intent_error (cdl_tcb_intent tcb)) root_tcb_id sa \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> no_pending sa \<and> ?Pd2.10 s sa\<rbrace>
 2. \<And>s has_kids sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrakk> \<Longrightarrow> ?P'216 s has_kids sa
 3. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 4. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 5. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.10 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 7. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.10 s\<rbrace>
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.10 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 9. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s has_kids sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)))) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s (InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0))))) sa\<rbrakk> \<Longrightarrow> (K (default_object nt (unat ts) minBound = Some (?obj219 s has_kids) \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case InvokeUntyped (Retype (cap_object root_cnode_cap, offset ucptr root_size) nt (unat ts) [(cap_object root_cnode_cap, offset ncptr root_size)] has_kids (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev219 s has_kids) obj_range free_range \<and>* ?P219 s has_kids)) sa
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Ps10 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. (\<lambda>a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) and (\<lambda>s. cdl_current_domain s = minBound) and cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev140 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.138 s iv)) a) and K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 2. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>?Ps10 s\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'255 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev253 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.254 s iv)\<rbrace>
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'244 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> ?P'255 s iv sa) \<and> ?P'244 s iv sa\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (8 subgoals):
 1. \<And>s iv rv sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?R263 s iv) sa\<rbrakk> \<Longrightarrow> cdl.lift ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev253 s iv) obj_range free_range \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RestartCap \<and>* ?P2.254 s iv) sa
 2. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'244 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 3. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* ?R263 s iv) sa) \<and> ?P'244 s iv sa\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 4. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 6. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 8. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (7 subgoals):
 1. \<And>s iv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P'244 s iv\<rbrace> set_cap (root_tcb_id, tcb_pending_op_slot) RestartCap \<lbrace>\<lambda>rv. K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1))\<rbrace>
 2. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev269 s iv) obj_range free_range \<and>* ?P2.270 s iv) sa) \<and> ?P'244 s iv sa\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 3. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 5. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 7. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd10 s cs c ref\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev269 s iv) obj_range free_range \<and>* ?P2.270 s iv) sa) \<and> K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1)) sa\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?Pd10 s xa (fst rv) (snd rv)\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s c ref cs. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; nt \<noteq> UntypedType \<and> c = UntypedCap dev obj_range free_range \<and> cs = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrakk> \<Longrightarrow> \<lbrace>?P'275 s c ref cs\<rbrace> decode_invocation c ref cs (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. (cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (K (default_object nt (unat ts) minBound = Some obj \<and> nt \<noteq> UntypedType \<and> free_range \<subseteq> tot_free_range \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> finite tot_free_range) sa \<and> cdl_current_domain sa = minBound) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap (?dev269 s iv) obj_range free_range \<and>* ?P2.270 s iv) sa) \<and> K (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, ucptr_slot) nt (unat ts) [(root_cnode, ncptr_slot)] has_kids 1)) sa\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'275 s (fst rv) (snd rv) xa and K (nt \<noteq> UntypedType \<and> fst rv = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s ref. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent; nt \<noteq> UntypedType\<rbrakk> \<Longrightarrow> \<lbrace>?P'275 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace> decode_invocation (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)) \<lbrace>\<lambda>iv sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> (case iv of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap (?dev269 s iv) obj_range free_range \<and>* ?P2.270 s iv) sa \<and> (\<exists>has_kids. iv = InvokeUntyped (Retype (root_cnode, offset ucptr root_size) nt (unat ts) [(root_cnode, offset ncptr root_size)] has_kids (Suc 0)))\<rbrace>, \<lbrace>\<lambda>rv s. cdl_cdt s child = Some parent \<and> cdl_current_thread s = Some root_tcb_id \<and> cdl_current_domain s = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) s\<rbrace>
 2. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. ?P'275 s (fst rv) (snd rv) xa and K (nt \<noteq> UntypedType \<and> fst rv = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal (6 subgoals):
 1. \<And>s ref. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent; nt \<noteq> UntypedType\<rbrakk> \<Longrightarrow> nt \<noteq> UntypedType
 2. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. (\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> (case InvokeUntyped (Retype (snd rv) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd rv) sa) (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.284 s (fst rv) (snd rv) xa sa) sa \<and> (\<exists>has_kids. InvokeUntyped (Retype (snd rv) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd rv) sa) (Suc 0)) = InvokeUntyped (Retype (root_cnode, offset ucptr root_size) nt (unat ts) [(root_cnode, offset ncptr root_size)] has_kids (Suc 0)))) and (\<lambda>a. cdl_cdt a child = Some parent \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_cnode_cap root_cnode_cap) and K (nt \<noteq> UntypedType \<and> fst rv = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (5 subgoals):
 1. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_extra_caps root_tcb_id [croot] \<lbrace>\<lambda>xa. (\<lambda>sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> (case InvokeUntyped (Retype (snd rv) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd rv) sa) (Suc 0)) of InvokeUntyped (Retype uref nt ts dest has_kids n) \<Rightarrow> has_kids) \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.284 s (fst rv) (snd rv) xa sa) sa \<and> (\<exists>has_kids. InvokeUntyped (Retype (snd rv) nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children (snd rv) sa) (Suc 0)) = InvokeUntyped (Retype (root_cnode, offset ucptr root_size) nt (unat ts) [(root_cnode, offset ncptr root_size)] has_kids (Suc 0)))) and (\<lambda>a. cdl_cdt a child = Some parent \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a) and K (is_cnode_cap root_cnode_cap) and K (nt \<noteq> UntypedType \<and> fst rv = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)])\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (5 subgoals):
 1. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> doE x <- lookup_cap_and_slot root_tcb_id croot;
returnOk [x]
odE \<lbrace>\<lambda>xa sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd rv) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.284 s (fst rv) (snd rv) xa sa) sa \<and> snd rv = (root_cnode, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst rv = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (6 subgoals):
 1. \<And>s rv rva. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P'290 s rv rva\<rbrace> returnOk [rva] \<lbrace>\<lambda>xa sa. cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd rv) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.284 s (fst rv) (snd rv) xa sa) sa \<and> snd rv = (root_cnode, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst rv = UntypedCap dev obj_range free_range \<and> xa = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_cap_and_slot root_tcb_id croot \<lbrace>?P'290 s rv\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 4. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 6. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (5 subgoals):
 1. \<And>s rv. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?Pd1.10 s (fst rv) (snd rv)\<rbrace> lookup_cap_and_slot root_tcb_id croot \<lbrace>\<lambda>rva a. cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl_cdt a child = Some parent \<and> (\<not> has_children (snd rv) a \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.284 s (fst rv) (snd rv) [rva] a) a \<and> snd rv = (root_cnode, offset ucptr root_size) \<and> cdl_cdt a child = Some parent \<and> cdl_current_thread a = Some root_tcb_id \<and> cdl_current_domain a = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) a \<and> fst rv = UntypedCap dev obj_range free_range \<and> [rva] = [(root_cnode_cap, root_cnode, offset croot root_size)]\<rbrace>, \<lbrace>\<lambda>rv s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ?Pd1.10 s (fst rv) (snd rv) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 3. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 5. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. ((\<forall>c. reset_cap_asid c = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd rv) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.308 s (fst rv) (snd rv) sa c) sa \<and> snd rv = (root_cnode, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst rv = UntypedCap dev obj_range free_range \<and> [(c, cap_object (?cap307 s (fst rv) (snd rv)), offset croot root_size)] = [(root_cnode_cap, root_cnode, offset croot root_size)]) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (fst rv) (snd rv) \<and>* \<box> (root_size, word_bits) : ?cap305 s (fst rv) (snd rv) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (fst rv) (snd rv)) sa) \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s rv. ?P2.308 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap305 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap307 s (fst rv) (snd rv)
\<lambda>s rv. ?cap305 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap306 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (4 subgoals):
 1. \<And>s. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?Pd2.220 s\<rbrace> lookup_cap_and_slot root_tcb_id ucptr \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd rv) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c fst rv \<and>* ?P2.308 s (fst rv) (snd rv) sa c) sa \<and> snd rv = (cap_object root_cnode_cap, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst rv = UntypedCap dev obj_range free_range \<and> c = root_cnode_cap \<and> cap_object (?cap307 s (fst rv) (snd rv)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (fst rv) (snd rv) \<and>* \<box> (root_size, word_bits) : ?cap305 s (fst rv) (snd rv) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (fst rv) (snd rv)) sa \<and> \<not> ep_related_cap (fst rv)\<rbrace>, \<lbrace>\<lambda>y s. False\<rbrace>
 2. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv. ?Pd2.220 s\<rbrace>
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; ?Pd2.220 s sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 4. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s rv. ?P2.308 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = reset_cap_asid (UntypedCap dev obj_range free_range) \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c fst (c, cap_object (?cap326 s), offset ucptr root_size) \<and>* ?P2.308 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa ca) sa \<and> snd (c, cap_object (?cap326 s), offset ucptr root_size) = (cap_object root_cnode_cap, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst (c, cap_object (?cap326 s), offset ucptr root_size) = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) \<and>* \<box> (root_size, word_bits) : ?cap305 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) sa \<and> \<not> ep_related_cap (fst (c, cap_object (?cap326 s), offset ucptr root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; (\<forall>c. reset_cap_asid c = reset_cap_asid (UntypedCap dev obj_range free_range) \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c fst (c, cap_object (?cap326 s), offset ucptr root_size) \<and>* ?P2.308 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa ca) sa \<and> snd (c, cap_object (?cap326 s), offset ucptr root_size) = (cap_object root_cnode_cap, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst (c, cap_object (?cap326 s), offset ucptr root_size) = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) \<and>* \<box> (root_size, word_bits) : ?cap305 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) sa \<and> \<not> ep_related_cap (fst (c, cap_object (?cap326 s), offset ucptr root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s rv. ?P2.308 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (3 subgoals):
 1. \<And>s. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> \<lbrace>?P10 s\<rbrace> update_thread root_tcb_id (cdl_tcb_intent_update (\<lambda>x. \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr>)) \<lbrace>\<lambda>rv sa. (\<forall>c. reset_cap_asid c = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* ?P2.308 s c (cap_object (?cap326 s), offset ucptr root_size) sa ca) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s c (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s c (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s c (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s c (cap_object (?cap326 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa\<rbrace>
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; (\<forall>c. reset_cap_asid c = reset_cap_asid (UntypedCap dev obj_range free_range) \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c fst (c, cap_object (?cap326 s), offset ucptr root_size) \<and>* ?P2.308 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa ca) sa \<and> snd (c, cap_object (?cap326 s), offset ucptr root_size) = (cap_object root_cnode_cap, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst (c, cap_object (?cap326 s), offset ucptr root_size) = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) \<and>* \<box> (root_size, word_bits) : ?cap305 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) sa \<and> \<not> ep_related_cap (fst (c, cap_object (?cap326 s), offset ucptr root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 3. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> ?P10 s (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s rv. ?P2.308 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; (\<forall>c. reset_cap_asid c = reset_cap_asid (UntypedCap dev obj_range free_range) \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (snd (c, cap_object (?cap326 s), offset ucptr root_size)) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c fst (c, cap_object (?cap326 s), offset ucptr root_size) \<and>* ?P2.453 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) ca sa) sa \<and> snd (c, cap_object (?cap326 s), offset ucptr root_size) = (cap_object root_cnode_cap, offset ucptr root_size) \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> fst (c, cap_object (?cap326 s), offset ucptr root_size) = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) \<and>* \<box> (root_size, word_bits) : ?cap305 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size)) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (fst (c, cap_object (?cap326 s), offset ucptr root_size)) (snd (c, cap_object (?cap326 s), offset ucptr root_size))) sa \<and> \<not> ep_related_cap (fst (c, cap_object (?cap326 s), offset ucptr root_size))) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.453 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.453 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range \<and> cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s) \<and> (\<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) \<and> cdl_cdt (kernel_state s) child = Some parent; (\<forall>c. reset_cap_asid c = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* ?P2.473 s c (cap_object (?cap326 s), offset ucptr root_size) ca sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s c (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s c (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s c (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s c (cap_object (?cap326 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; root_cnode = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.473 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.473 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; \<forall>c. reset_cap_asid c = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>ca. reset_cap_asid ca = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c c \<and>* ?P2.509 s c (cap_object (?cap326 s), offset ucptr root_size) ca sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = UntypedCap dev obj_range free_range \<and> ca = root_cnode_cap \<and> cap_object (?cap307 s c (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s c (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s c (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s c (cap_object (?cap326 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap c; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.509 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.509 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; reset_cap_asid (UntypedCap dev obj_range free_range) = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>c. reset_cap_asid c = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.513 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) c sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> UntypedCap dev obj_range free_range = UntypedCap dev obj_range free_range \<and> c = root_cnode_cap \<and> cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap (UntypedCap dev obj_range free_range)\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.513 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.513 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; (\<forall>c. reset_cap_asid c = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.524 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) c sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = root_cnode_cap \<and> cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa \<and> \<not> ep_related_cap (UntypedCap dev obj_range free_range)\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.524 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.524 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; \<forall>c. reset_cap_asid c = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.536 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) c sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> c = root_cnode_cap \<and> cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range)\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.536 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.536 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range); reset_cap_asid root_cnode_cap = reset_cap_asid root_cnode_cap \<longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.540 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) root_cnode_cap sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> root_cnode_cap = root_cnode_cap \<and> cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.540 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.540 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range); cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl_cdt sa child = Some parent \<and> (\<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range) \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.549 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) root_cnode_cap sa) sa \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt sa child = Some parent \<and> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa \<and> cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.549 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.549 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range); cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cdl_cdt sa child = Some parent; \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range; cdl_current_domain sa = minBound; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.615 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) root_cnode_cap sa) sa; cap_object (?cap326 s) = cap_object root_cnode_cap; cdl_cdt sa child = Some parent; cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa; cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl_current_thread sa = Some root_tcb_id \<and> cdl_current_domain sa = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa \<and> cdl_cdt sa child = Some parent
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.615 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.615 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range); \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.621 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) root_cnode_cap sa) sa; cap_object (?cap326 s) = cap_object root_cnode_cap; cdl_cdt sa child = Some parent; cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) sa; cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.621 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.621 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) sa; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range); \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.627 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) root_cnode_cap sa) sa; cap_object (?cap326 s) = cap_object root_cnode_cap; cdl_cdt sa child = Some parent; cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* ?R326 s) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.627 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.627 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (2 subgoals):
 1. \<And>s sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state s) child = Some parent; cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) sa; \<not> ep_related_cap (UntypedCap dev obj_range free_range); \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) sa \<longrightarrow> free_range = obj_range; cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* ?P2.634 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size) root_cnode_cap sa) sa; cap_object (?cap326 s) = cap_object root_cnode_cap; cdl_cdt sa child = Some parent; cdl_current_thread sa = Some root_tcb_id; cdl_current_domain sa = minBound; cap_object (?cap307 s (UntypedCap dev obj_range free_range) (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) sa
 2. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* cdl.lift (?P2.399 s x xa) (kernel_state sa)) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* (\<lambda>a. True)) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s c. ?P2.634 s c (cap_object (?cap326 s), offset ucptr root_size) \<equiv>\<^sup>? \<lambda>s c ca. cdl.lift (?P2.399 s c ca)
\<lambda>s rv sa c. ?P2.634 s (fst rv) (snd rv) c sa \<equiv>\<^sup>? \<lambda>s rv sa c. ?P2.284 s (fst rv) (snd rv) [(c, cap_object (?cap305 s (fst rv) (snd rv)), offset croot root_size)] sa
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s ref. ?P2.284 s (UntypedCap dev obj_range free_range) ref [(root_cnode_cap, root_cnode, offset croot root_size)] \<equiv>\<^sup>? \<lambda>s ref sa. ?P2.270 s (InvokeUntyped (Retype ref nt (unat ts) [(cap_object root_cnode_cap, unat ncptr_slot_nat)] (has_children ref sa) (Suc 0))) proof (prove)
goal (1 subgoal):
 1. \<And>s sa. \<lbrakk>cap_object root_cnode_cap = root_cnode; ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; ((\<lambda>y. nt \<noteq> UntypedType \<and> default_object nt (unat ts) minBound = Some obj \<and> free_range \<subseteq> tot_free_range) and (\<lambda>s. cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_cnode \<mapsto>f CNode (empty_cnode root_size) \<and>* (root_cnode, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (root_cnode, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (root_cnode, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state s)) and (\<lambda>s. \<not> has_children (root_cnode, offset ucptr root_size) (kernel_state s) \<longrightarrow> obj_range = free_range) and (\<lambda>s. cdl_cdt (kernel_state s) child = Some parent)) s; s = sa\<rbrakk> \<Longrightarrow> \<not> cdl_intent_error \<lparr>cdl_intent_op = Some (UntypedIntent (UntypedRetypeIntent nt ts node_index 0 ncptr_slot_nat 1)), cdl_intent_error = False, cdl_intent_cap = ucptr, cdl_intent_extras = [croot], cdl_intent_recv_slot = None\<rparr> \<and> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x \<noteq> UntypedCap dev obj_range free_range \<or> (\<forall>xa. reset_cap_asid xa \<noteq> reset_cap_asid root_cnode_cap \<or> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> (\<not> \<not> has_children (cap_object (?cap326 s), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<longrightarrow>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>a. True))) (kernel_state sa) \<and> cap_object (?cap326 s) = cap_object root_cnode_cap \<and> cdl_cdt (kernel_state sa) child = Some parent \<and> cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 s x (cap_object (?cap326 s), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 s x (cap_object (?cap326 s), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 s x (cap_object (?cap326 s), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 s x (cap_object (?cap326 s), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 s \<and>* \<box> (root_size, word_bits) : ?cap326 s ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* (\<lambda>a. True)) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv) proof (prove)
goal (1 subgoal):
 1. \<And>sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent\<rbrakk> \<Longrightarrow> (cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound \<longrightarrow> (\<forall>x. reset_cap_asid x = UntypedCap dev obj_range free_range \<longrightarrow> (\<forall>xa. reset_cap_asid xa = reset_cap_asid root_cnode_cap \<longrightarrow> (has_children (cap_object (?cap326 sa), offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<longrightarrow>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>a. True))) (kernel_state sa) \<and> cap_object (?cap326 sa) = cap_object root_cnode_cap \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa) \<and> x = UntypedCap dev obj_range free_range \<and> xa = root_cnode_cap \<and> cap_object (?cap307 sa x (cap_object (?cap326 sa), offset ucptr root_size)) = cap_object root_cnode_cap) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap306 sa x (cap_object (?cap326 sa), offset ucptr root_size) \<and>* \<box> (root_size, word_bits) : ?cap305 sa x (cap_object (?cap326 sa), offset ucptr root_size) croot \<mapsto>u root_cnode_cap \<and>* ?R304 sa x (cap_object (?cap326 sa), offset ucptr root_size)) (kernel_state sa) \<and> \<not> ep_related_cap x) \<and> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c ?cap326 sa \<and>* \<box> (root_size, word_bits) : ?cap326 sa ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* (\<lambda>a. True)) (kernel_state sa)) \<and> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa)
flex-flex pairs:
\<lambda>s rv. ?cap307 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv)
\<lambda>s rv. ?cap306 s (fst rv) (snd rv) \<equiv>\<^sup>? \<lambda>s rv. ?cap305 s (fst rv) (snd rv) proof (prove)
goal (9 subgoals):
 1. \<And>sa x xa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range; reset_cap_asid xa = reset_cap_asid root_cnode_cap\<rbrakk> \<Longrightarrow> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<or> free_range = obj_range
 2. \<And>sa x xa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range; reset_cap_asid xa = reset_cap_asid root_cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c - \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<and>* ((cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c x \<longrightarrow>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>a. True))) (kernel_state sa)
 3. \<And>sa x xa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range; reset_cap_asid xa = reset_cap_asid root_cnode_cap\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* (\<lambda>s. True)) (kernel_state sa)
 4. \<And>sa x xa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range; reset_cap_asid xa = reset_cap_asid root_cnode_cap\<rbrakk> \<Longrightarrow> x = UntypedCap dev obj_range free_range
 5. \<And>sa x xa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range; reset_cap_asid xa = reset_cap_asid root_cnode_cap\<rbrakk> \<Longrightarrow> xa = root_cnode_cap
 6. \<And>sa x. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap croot \<mapsto>u root_cnode_cap \<and>* ?R304 sa x (cap_object root_cnode_cap, offset ucptr root_size)) (kernel_state sa)
 7. \<And>sa x. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound; reset_cap_asid x = UntypedCap dev obj_range free_range\<rbrakk> \<Longrightarrow> \<not> ep_related_cap x
 8. \<And>sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent; cdl_current_thread (kernel_state sa) = Some root_tcb_id \<and> cdl_current_domain (kernel_state sa) = minBound\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* \<box> (root_size, word_bits) : root_cnode_cap ucptr \<mapsto>u UntypedCap dev obj_range free_range \<and>* (\<lambda>a. True)) (kernel_state sa)
 9. \<And>sa. \<lbrakk>ucptr_slot = offset ucptr root_size; is_cnode_cap root_cnode_cap; ncptr_slot = offset ncptr root_size; unat ncptr_slot_nat = offset ncptr root_size; one_lvl_lookup root_cnode_cap 32 root_size; guard_equal root_cnode_cap ucptr 32; guard_equal root_cnode_cap croot 32; root_cnode = cap_object root_cnode_cap; nt \<noteq> UntypedType; default_object nt (unat ts) minBound = Some obj; free_range \<subseteq> tot_free_range; cdl.lift (root_tcb_id \<mapsto>f Tcb tcb \<and>* (root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* cap_object root_cnode_cap \<mapsto>f CNode (empty_cnode root_size) \<and>* (cap_object root_cnode_cap, offset ucptr root_size) \<mapsto>c UntypedCap dev obj_range free_range \<and>* (cap_object root_cnode_cap, offset ncptr root_size) \<mapsto>c NullCap \<and>* (SETSEPCONJ ptr:tot_free_range. ptr \<mapsto>o Untyped) \<and>* (root_tcb_id, tcb_cspace_slot) \<mapsto>c root_cnode_cap \<and>* (cap_object root_cnode_cap, offset croot root_size) \<mapsto>c root_cnode_cap \<and>* P) (kernel_state sa); \<not> has_children (cap_object root_cnode_cap, offset ucptr root_size) (kernel_state sa) \<longrightarrow> obj_range = free_range; cdl_cdt (kernel_state sa) child = Some parent\<rbrakk> \<Longrightarrow> cdl.lift ((root_tcb_id, tcb_pending_op_slot) \<mapsto>c RunningCap \<and>* root_tcb_id \<mapsto>f Tcb tcb \<and>* (\<lambda>s. True)) (kernel_state sa) proof (prove)
goal:
No subgoals!